PT-2025-43524 · Unknown+1 · Levlaz Braindump+1

Publicado 2025-10-23 · Atualizado 2025-10-28 · CVE-2025-61132

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions levlaz braindump version 0.4.14

Description A Host Header Injection flaw exists in the password reset functionality of the software. This allows remote attackers to manipulate the Host header during password reset link generation, specifically when Flask's url for( external=True) is used without a defined SERVER NAME. Successful exploitation can lead to password reset poisoning and subsequent account takeover. The vulnerable component is the password reset functionality. The url for() function is used to generate reset links.

Recommendations Versions prior to 0.4.14 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-620

Identificadores relacionados

CVE-2025-61132

Produtos afetados

Flask

Levlaz Braindump

Referências · 10

• https://github.com/levlaz/braindump/blob/9640dd03f99851dbd34dd6cac98a747a4a591b01/app/templates/auth/email/reset_password.html#L1-L8 · Nota
• https://github.com/levlaz/braindump/blob/9640dd03f99851dbd34dd6cac98a747a4a591b01/app/auth/views.py#L131-L148 · Nota
• https://twitter.com/cracbot/status/1983126644589244701 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1981417836716143065 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-61132 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-61132 · Nota de Segurança
• https://portswigger.net/web-security/host-header/exploiting/password-reset-poisoning · Nota
• https://gist.github.com/BrookeYangRui/94c3bee0c2cbc1ed81a21d4448550c21 · Nota
• https://twitter.com/CVEnew/status/1981383865147998462 · Publicação no Twitter
• https://drive.google.com/file/d/1FmkctLdOTGMdy6GgLaTzfxemdVDeiA7J/view?usp=sharing · Nota