GitHub Advisoryadvisory · Packagist

GHSA-p757-4v3p-j74f Known vulnerable to account takeover via host header injection attack in v1.3.1

HIGH Published 2022-07-09 Modified 2022-07-22 Official page ↗
Aliases
CVE-2022-33011
Ecosystem
Packagist
Packages
idno/known
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2022-07-15

Affected packages

• Packagist idno/known: <= 1.3.1 (no fix yet)

Description

Known v1.3.1 was discovered to allow attackers to perform an account takeover via a host header injection attack. The researcher report indicates that versions 1.3.1 and prior are vulnerable. Version 1.2.2 is the last version tagged on GitHub and in Packagist, and development related to the 1.3.x branch is currently on the `dev` branch of the idno/known repository.

Related

Alias · CVE (1)

  • CVE-2022-33011 Known v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover via a host header injection attack. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References