CVE Vulnerability

CVE-2022-29933

Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration).

6.8 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

8.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/craftcms/cms/blob/develop/CHANGELOG.md Release Notes Third Party Advisory
http://packetstormsecurity.com/files/166989/Craft-CMS-3.7.36-Password-Reset-Poisoning-Attack.html Exploit Third Party Advisory
https://sec-consult.com/vulnerability-lab/ Third Party Advisory
https://sec-consult.com/vulnerability-lab/advisory/password-reset-poisoning-attack-craft-cms/ Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:craftcms:craft_cms:*:*:*:*:*:*:*:*
Information

Published : 2022-05-09 06:15

Updated : 2022-05-18 02:14

NVD link : CVE-2022-29933

Mitre link : CVE-2022-29933

Products Affected
No products.
CWE
CWE-640

Weak Password Recovery Mechanism for Forgotten Password