PT-2022-19917 · Craft Cms · Craft Cms
Sandro Einfeldt
·
Published
2022-05-09
·
Updated
2022-05-18
·
CVE-2022-29933
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Craft CMS versions 3.7.36 and earlier
Description
The issue allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send
X-Forwarded-Host to the "/index.php?p=admin/actions/users/send-password-reset-email" URI. The vendor's position is that a customer can already work around this by adjusting the configuration, i.e., by not using the default configuration.Recommendations
For Craft CMS versions 3.7.36 and earlier, consider adjusting the configuration to avoid using the default settings as a workaround to mitigate the risk of exploitation.
As a temporary workaround, consider restricting access to the "/index.php?p=admin/actions/users/send-password-reset-email" URI until a more permanent solution is available.
Avoid using the default configuration to minimize the risk of exploitation.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Craft Cms