CVE-2024-26470 FullStackHero's WebAPI Boilerplate host header injection vulnerability
Attackers can leak password reset tokens via host header injection in the forgot password function, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-26470?
CVE-2024-26470 is a high-severity vulnerability in n/a, published on 27 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attackers to leak the password reset token via a crafted request.
Weakness: CWE-200
Which versions are affected by CVE-2024-26470?
2 open source packages ship an affected version, including FullStackHero.WebAPI.Boilerplate. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
FullStackHero.WebAPI.Boilerplate NuGet | From 1.0.0 to 1.0.1 | None |
FullStackHero.WebAPI.Boilerplate NuGet | From 1.0.0 to 1.0.1 | None |
Products include Fullstackhero .Net 9 Starter Kit.
How do I fix CVE-2024-26470?
No fix has been published for CVE-2024-26470 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-26470 being exploited?
There is no known exploitation of CVE-2024-26470 in the wild and no public exploit code.
Sources
Also known as GHSA-75x2-6h4m-h6mx.