CVE-2017-9303

Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host...

CVE-2017-9303

The CVE affects Laravel 5.4.x prior to 5.4.22, where the host portion of the password-reset URL is not properly constrained. This enables phishing-like abuse by an attacker-controlled host. Root cause: insufficient validation of the password-reset URL host. Impact: remote attackers could lure use...