PT-2025-28175 · Jobcenter · Jobcenter

Rui Yang + 1 · Published 2025-07-07 · Updated 2025-07-07 · CVE-2025-43932

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: JobCenter versions through 7e7b0b2

Description: The issue allows for account takeover via the password reset feature. This is because the SERVER NAME is not configured, causing the password reset to depend on the Host HTTP header.

Recommendations: For versions through 7e7b0b2, configure the SERVER NAME to prevent the password reset feature from relying on the Host HTTP header. As a temporary workaround, consider restricting access to the password reset feature until the SERVER NAME is properly configured.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2025-43932

Affected Products

Jobcenter

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-43932 · Security Note
• https://github.com/guomaoqiu/JobCenter/issues/18 · Note
• https://github.com/guomaoqiu/JobCenter/blob/7e7b0b2f756d66bba7e592a6c8952c78a3573d9c/app/templates/auth/email/reset_password.txt · Note
• https://twitter.com/VulmonFeeds/status/1942365939967648184 · Twitter Post
• https://twitter.com/CVEnew/status/1942246217389613358 · Twitter Post