CVE-2021-25994: Injection in UserFrosting

January 6, 2022

In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.

References

github.com/advisories/GHSA-cv25-3gmg-c6m8
github.com/userfrosting/UserFrosting/commit/796dd78757902435d1bd286415feea78098e45ba
nvd.nist.gov/vuln/detail/CVE-2021-25994
www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25994

Detect and mitigate CVE-2021-25994 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →