CVE-2024-29643 croogo Host header injection
Attackers can inject malicious Host headers in Croogo CMS RSS feeds, potentially bypassing security controls or poisoning caches.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-29643?
CVE-2024-29643 is a critical vulnerability in n/a, published on 18 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component.
Weakness: CWE-444
Which versions are affected by CVE-2024-29643?
2 open source packages ship an affected version, including croogo/croogo. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
croogo/croogo Packagist | All versions to 3.0.2 | None |
croogo/croogo Packagist | All versions to 3.0.2 | None |
Products include Croogo Croogo.
How do I fix CVE-2024-29643?
No fix has been published for CVE-2024-29643 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-29643 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-29643 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-847x-x4jg-6gf4.