PT-2022-15835 · Unknown · Motor-Admin

Published 2022-06-22 · Updated 2022-06-29 · CVE-2022-23079

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions motor-admin versions 0.0.1 through 0.2.56

Description The issue concerns host header injection in the password reset functionality. A malicious actor can exploit this to send fake password reset emails to arbitrary victims.

Recommendations For motor-admin versions 0.0.1 through 0.2.56, consider disabling the password reset functionality until a patch is available to prevent exploitation. Restrict access to the password reset module to minimize the risk of fake password reset emails being sent to victims.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2022-23079

Affected Products

Motor-Admin

References · 5

• 🔥 https://mend.io/vulnerability-database/CVE-2022-23079 · Exploit
• https://github.com/motor-admin/motor-admin/commit/a461b7507940a1fa062836daa89c82404fe3ecf9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23079 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23079 · Vendor Advisory
• https://t.me/cibsecurity/44935 · Telegram Post