Lucene search
Veracode Vulnerability DatabaseVERACODE:31913HistorySep 02, 2021 - 6:48 a.m.
Malicious Password Resetting
2021-09-0206:48:53
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
14
vulnerability
password resetting
attacker
email
akaunting instance
EPSS
0.002
Percentile
57.0%
laravel/laravel is doing malicious password resetting. The vulnerability exists because an attacker who knows the target’s e-mail address can send proxy password reset requests through a running Akaunting instance.
References
github.com/advisories/GHSA-246r-r2wf-frhx
github.com/laravel/laravel/commit/b7cde8b495e183f386da63ff7792e0dea9cfcf56
github.com/laravel/laravel/pull/5477
www.laravel-enlightn.com/docs/security/host-injection-analyzer.html
www.laravel-enlightn.com/docs/security/host-injection-analyzer.html
www.rapid7.com/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixed/
www.rapid7.com/blog/post/2021/07/27/multiple-open-source-web-app-vulnerabilities-fixed/
Related
osv
osv
Malicious password-reset in Akaunting
2021-09-01 18:31:36
CVE-2021-36804
2021-08-04 23:15:08
prion
prion
Spoofing
2021-08-04 23:15:00
cve
cve
CVE-2021-36804
2021-08-04 23:15:08
github
github
Malicious password-reset in Akaunting
2021-09-01 18:31:36
gitlab
gitlab
Weak Password Recovery Mechanism for Forgotten Password
2021-09-01 00:00:00
cvelist
cvelist
CVE-2021-36804 Akaunting Password Reset Relay
2021-08-04 22:20:44
nvd
nvd
CVE-2021-36804
2021-08-04 23:15:08
thn
thn
Several Bugs Found in 3 Open-Source Software Used by Several Businesses
2021-07-27 13:01:00
rapid7blog
rapid7blog
Multiple Open Source Web App Vulnerabilities Fixed
2021-07-27 14:30:24