CVE-2022-29933 Improper account password reset in Craft CMS
An attacker can take over accounts by manipulating the X-Forwarded-Host header during password reset if the application uses default configuration settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-29933?
CVE-2022-29933 is a high-severity authentication bypass vulnerability in Craftcms Craft Cms, published on 9 May 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration).
Weakness: CWE-640
Which versions are affected by CVE-2022-29933?
2 open source packages ship an affected version, including craftcms/cms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/cms Packagist | All versions | 3.7.36 |
craftcms/cms Packagist | All versions | 3.7.36 |
Products include Craftcms Craft Cms.
How do I fix CVE-2022-29933?
Upgrade craftcms/cms to 3.7.36 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2022-29933 being exploited?
There is no known exploitation of CVE-2022-29933 in the wild and no public exploit code.
Other vulnerabilities in Craftcms Craft Cms
Sources
Also known as GHSA-5cjr-78cq-3wrg.