CVE-2022-23079 motoradmin - host header Injection in the reset password functionality

2022-06-2213:05:10

CWE-116

Mend

www.cve.org

cve-2022-23079

motor-admin

host header

password reset

vulnerability

malicious actor

AI Score

7.3

Confidence

Low

EPSS

Percentile

12.8%

JSON

In motor-admin versions 0.0.1 through 0.2.56 are vulnerable to host header injection in the password reset functionality where malicious actor can send fake password reset email to arbitrary victim.

CNA Affected

[
  {
    "product": "motor-admin",
    "vendor": "motor-admin",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "0.0.1",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "0.2.56",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]