Описание
CouchAuth has a Server-Side Template Injection vulnerability in its email functionality
A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information.
Пакеты
Наименование
@perfood/couch-auth
npm
Затронутые версииВерсия исправления
<= 0.21.2
Отсутствует
Связанные уязвимости
CVSS3: 7.3
nvd
12 месяцев назад
A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information