PT-2024-31867 · Unknown · Bookreviewlibrary

Sourajeet Majumder · Published 2024-09-26 · Updated 2024-10-01 · CVE-2024-45981

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BookReviewLibrary version 1.0

Description A host header injection issue allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This is achieved through manipulating the host header, which can lead to unauthorized access to sensitive information.

Recommendations For BookReviewLibrary version 1.0, consider disabling password reset functionality until a patch is available to prevent exploitation of the host header injection issue. Restrict access to password reset links to minimize the risk of attackers crafting malicious links. Avoid using user-interaction-based password reset mechanisms in the affected version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-45981

Affected Products

Bookreviewlibrary

References · 7

• 🔥 https://github.com/soursec/CVEs/tree/main/CVE-2024-45981 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-45981 · Security Note
• https://t.me/cvenotify/96188 · Telegram Post
• https://twitter.com/CVEnew/status/1839348153264345116 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1839391653791944894 · Twitter Post
• https://t.me/cvedetector/6427 · Telegram Post
• https://twitter.com/cracbot/status/1840995139231392155 · Twitter Post