PyPI/indico CVE-2021-30185: unknown, EPSS 1.05%

CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link.

Action: Upgrade indico to 2.3.4 or later.

pip install indico==2.3.4

Affected

Fixed versions

Sources

• osv: PYSEC-2021-18
• https://github.com/indico/indico/releases/tag/v2.3.4
• https://www.shorebreaksecurity.com/blog/
• https://github.com/advisories/GHSA-wgpj-7c2j-vfjm

CVE-2021-30185 · published 2021-04-07T14:15:00Z · modified 2023-11-08T04:05:45.785370Z · JSON