CVE-2022-33011
1 advisory.
Packagist/idno/known CVE-2022-33011: high 8.8, EPSS 1.52%
Known vulnerable to account takeover via host header injection attack in v1.3.1
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 1.3.1 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-p757-4v3p-j74f
- https://nvd.nist.gov/vuln/detail/CVE-2022-33011
- https://blog.jitendrapatro.me/multiple-vulnerabilities-in-idno-known-php-cms-software
- https://github.com/idno/known
- https://github.com/idno/known/blob/dev/composer.json#L4
- https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Account%20Takeover#account-takeover-through-password-reset-poisoning
- https://www.pethuraj.com/blog/how-i-earned-800-for-host-header-injection-vulnerability
CVE-2022-33011 · published · modified · JSON