PT-2025-28186 · Natours · Natours

0Xkalawy · Published 2025-07-07 · Updated 2025-07-07 · CVE-2025-53373

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Natours (affected versions not specified)

Description: The issue allows an attacker to take over any victim account by injecting an attacker-controlled server domain in the Host header when requesting the "/forgetpassword" endpoint.

Recommendations: For all affected versions, update to the version that includes the fix released in commit 7401793a8d9ed0f0c250c4e0ee2815d685d7a70b. As a temporary workaround, consider restricting access to the "/forgetpassword" endpoint until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2025-53373

GHSA-8GMW-7P75-58QV

Affected Products

Natours

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53373.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-53373 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53373 · Security Note
• https://github.com/ahmed-elgaml11/Natours/security/advisories/GHSA-8gmw-7p75-58qv · Note
• https://github.com/ahmed-elgaml11/Natours/commit/7401793a8d9ed0f0c250c4e0ee2815d685d7a70b · Note
• https://twitter.com/VulmonFeeds/status/1942350582754197994 · Twitter Post
• https://twitter.com/CveFindCom/status/1942254662758895866 · Twitter Post
• https://twitter.com/CVEnew/status/1942250521051435424 · Twitter Post