Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS03NXgyLTZoNG0taDZteM4AA5oj
FullStackHero's WebAPI Boilerplate host header injection vulnerability
A host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attackers to leak the password reset token via a crafted request.
Permalink: https://github.com/advisories/GHSA-75x2-6h4m-h6mxJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03NXgyLTZoNG0taDZteM4AA5oj
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 9 months ago
Updated: 3 months ago
EPSS Percentage: 0.00045
EPSS Percentile: 0.16558
Identifiers: GHSA-75x2-6h4m-h6mx, CVE-2024-26470
References:
- https://nvd.nist.gov/vuln/detail/CVE-2024-26470
- https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2024-26470
- https://github.com/fullstackhero/dotnet-webapi-boilerplate
- https://www.nuget.org/packages/FullStackHero.WebAPI.Boilerplate
- https://github.com/advisories/GHSA-75x2-6h4m-h6mx
Blast Radius: 1.0
Affected Packages
nuget:FullStackHero.WebAPI.Boilerplate
Dependent packages: 0Dependent repositories: 0
Downloads: 19,911 total
Affected Version Ranges: >= 1.0.0, <= 1.0.1
No known fixed version
All affected versions: 1.0.0