CVE-2023-38877

A host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This allows an attacker to reset other users' passwords.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.88% chance of exploitation in the next 30 days, 57th percentile

Published

2023-09-28

Updated

2024-09-23

Proof-of-concept exploits (1)

• dub-flow/vulnerability-research/tree/main/CVE-2023-38877

References

• CVE Record
• NVD entry

Related

• CVE-2023-38870
• CVE-2023-38872
• CVE-2023-38874
• CVE-2023-40618
• CVE-2023-38875
• CVE-2023-38879