Описание
Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header.
Ссылки
- Vendor AdvisoryMitigation
Уязвимые конфигурации
Конфигурация 1Версия до 5.0.0 (исключая)
cpe:2.3:a:passbolt:passbolt_api:*:*:*:*:*:*:*:*
EPSS
Процентиль: 11%
0.00039
Низкий
7.5 High
CVSS3
Дефекты
CWE-348
Связанные уязвимости
CVSS3: 7.5
github
8 месяцев назад
Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header.
EPSS
Процентиль: 11%
0.00039
Низкий
7.5 High
CVSS3
Дефекты
CWE-348