CWE-644 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-644/ Thu, 23 Feb 2023 14:11:54 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-644 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-644/ 32 32 CVE-2021-41114 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-41114/ Thu, 23 Feb 2023 14:11:54 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-41114/ TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the frontend rendering process. Since […]

The post CVE-2021-41114 appeared first on CVE Vulnerability.

]]> TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the frontend rendering process. Since the host header itself is provided by the client, it can be forged to any value, even in a name-based virtual hosts environment. This vulnerability is the same as described in TYPO3-CORE-SA-2014-001 (CVE-2014-3941). A regression, introduced during TYPO3 v11 development, led to this situation. The already existing setting $GLOBALS[‘TYPO3_CONF_VARS’][‘SYS’][‘trustedHostsPattern’] (used as an effective mitigation strategy in previous TYPO3 versions) was not evaluated anymore, and reintroduced the vulnerability.

The post CVE-2021-41114 appeared first on CVE Vulnerability.

]]> CVE-2021-21265 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-21265/ Thu, 23 Feb 2023 14:06:58 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-21265/ October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. This has been addressed […]

The post CVE-2021-21265 appeared first on CVE Vulnerability.

]]> October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. In October before version 1.1.2, when running on poorly configured servers (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. This has been addressed in version 1.1.2 by adding a feature to allow a set of trusted hosts to be specified in the application. As a workaround one may set the configuration setting cms.linkPolicy to force.

The post CVE-2021-21265 appeared first on CVE Vulnerability.

]]>