Host-Header Injection

2021-03-1105:00:20

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

36.8%

JSON

october/october is vulnerable to host-header injection. The server is configured to accept a wildcard as a hostname and routes the requests regardless of the Host header value. This potentially allows for Host Header injection attacks to succeed and can cause unexpected behavior in the application.

CPENameOperatorVersion
october/octoberlev1.1.1

CPE	Name	Operator	Version
	october/october	le	v1.1.1

References

github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6

github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0

github.com/octobercms/october/security/advisories/GHSA-xhfx-hgmf-v6vp

0.001 Low

EPSS

Percentile

36.8%

JSON

Related for VERACODE:29666