Host Header Injection

2022-01-0403:30:28

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

userfrosting

host header

injection

vulnerability

url validation

password reset

account takeover

EPSS

0.002

Percentile

62.1%

JSON

userfrosting/userfrosting is vulnerable to host header injection. The library does not properly validate the URL for ‘forgot password’ function, allowing an attacker to reset the password and take over the user account by using maliciously crafted password reset link.