Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS03NXgyLTZoNG0taDZteM4AA5oj

FullStackHero's WebAPI Boilerplate host header injection vulnerability

A host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attackers to leak the password reset token via a crafted request.

Permalink: https://github.com/advisories/GHSA-75x2-6h4m-h6mx
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03NXgyLTZoNG0taDZteM4AA5oj
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 2 months ago
Updated: about 2 months ago

Identifiers: GHSA-75x2-6h4m-h6mx, CVE-2024-26470
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-26470
• https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2024-26470
• https://github.com/fullstackhero/dotnet-webapi-boilerplate
• https://www.nuget.org/packages/FullStackHero.WebAPI.Boilerplate
• https://github.com/advisories/GHSA-75x2-6h4m-h6mx

Repository: https://github.com/dub-flow/vulnerability-research
Blast Radius: 1.0

Affected Packages