CVE-2023-38877

A host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This allows an attacker to reset other users' passwords.

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

1.07% chance of exploitation in the next 30 days, 64th percentile

Published

2023-09-28

Updated

2024-09-23

Proof-of-concept exploits (1)

• dub-flow/vulnerability-research/tree/main/CVE-2023-3887751★ · 2024-03-10

Security advisories

• advisories/GHSA-hqp9-mrjw-7qq2
• gugoan/economizzer
• https://www.economizzer.org

References

• CVE Record
• NVD entry

Related

• CVE-2023-38870
• CVE-2023-38872
• CVE-2023-38874
• CVE-2023-40618