Lucene search
Veracode Vulnerability DatabaseVERACODE:20931HistoryJul 30, 2019 - 8:12 a.m.
Host Header Injection
2019-07-3008:12:04
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
6
0.001 Low
EPSS
Percentile
43.2%
invenio-app is vulnerable to host header injection. The attack exists because it only relies on APP_ALLOWED_HOSTS to whitelist allowed host headers, misconfiguring the web server to allow requests with any host header.
| CPE | Name | Operator | Version |
|---|---|---|---|
| invenio-app | eq | 1.1.0 | |
| invenio-app | le | 1.0.5 |
Related
github
github
Moderate severity vulnerability that affects invenio-app
2019-07-16 00:52:10
nvd
nvd
CVE-2019-1020006
2019-07-29 15:15:12
osv
osv
PYSEC-2019-24
2019-07-29 15:15:00
CVE-2019-1020006
2019-07-29 15:15:12
Moderate severity vulnerability that affects invenio-app
2019-07-16 00:52:10
prion
prion
Design/Logic Flaw
2019-07-29 15:15:00
cvelist
cvelist
CVE-2019-1020006
2019-07-29 14:10:07
cve
cve
CVE-2019-1020006
2019-07-29 15:15:12