GitHub Advisoryadvisory · NuGet

GHSA-75x2-6h4m-h6mx FullStackHero's WebAPI Boilerplate host header injection vulnerability

MEDIUM Published 2024-02-29 Modified 2024-03-01 Official page ↗
Aliases
CVE-2024-26470
Ecosystem
NuGet
Packages
FullStackHero.WebAPI.Boilerplate
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2024-03-01

Affected packages

• NuGet FullStackHero.WebAPI.Boilerplate: >= 1.0.0, <= 1.0.1 (no fix yet)

Description

A host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attackers to leak the password reset token via a crafted request.

Related

Alias · CVE (1)

  • CVE-2024-26470 A host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References