CVE-2021-25980highCWE-74

CVE-2021-25980: falha de alta gravidade em debiki talkyard

Talkyard - Host-Header Injection Leads to Account Takeover

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar talkyard

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.8epss 1.3%
In Talkyard, versions v0.04.01 through v0.6.74-WIP-63220cb, v0.2020.22-WIP-b2e97fe0e through v0.2021.02-WIP-879ef3fe1 and tyse-v0.2021.02-879ef3fe1-regular through tyse-v0.2021.28-af66b6905-regular, are vulnerable to Host Header Injection. By luring a victim application-user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
debiki · talkyard
CVEs relacionadas — debiki talkyard

No mesmo produto, das mais perigosas para as menos.

CVE-2021-25981CRITICALTalkyard - Insufficient Session ExpirationEPSS 2.5%