Injection in UserFrosting

2022-01-0622:22:32

Google

osv.dev

userfrosting

vulnerability

versions

host header injection

unauthenticated attacker

reset password

take over account

EPSS

0.002

Percentile

62.1%

JSON

In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.