CVE-2023-38877

State: Published
Severity: Not scored
Published: Sep 28, 2023
Updated: Sep 23, 2024
Reserved: Jul 25, 2023

Description

A host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This allows an attacker to reset other users' passwords.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://www.economizzer.org/
https://github.com/gugoan/economizzer/
https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38877

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.