8.1
CVE-2024-26470
- EPSS 1.04%
- Veröffentlicht 29.02.2024 01:44:18
- Zuletzt bearbeitet 30.04.2025 16:52:55
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
LoginA host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attackers to leak the password reset token via a crafted request.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fullstackhero ≫ .Net 9 Starter Kit Version1.0.0
Fullstackhero ≫ .Net 9 Starter Kit Version1.0.1
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.04% | 0.595 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 8.1 | 2.2 | 5.9 |
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
|
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2024-26470
https://github.com/fullstackhero/dotnet-webapi-boilerplate
https://www.nuget.org/packages/FullStackHero.WebAPI.Boilerplate