medium5.3
CVE-2022-25355
EC-CUBE improperly handles HTTP Host header values
Impact
EC-CUBE 3.0.0 to 3.0.18-p3 and EC-CUBE 4.0.0 to 4.1.1 improperly handle HTTP Host header values, which may lead a remote unauthenticated attacker to direct the vulnerable version of EC-CUBE to send an Email with some forged reissue-password URL to EC-CUBE users.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | ec-cube/ec-cube | >= 3.0.0, <= 3.0.18-p3 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ec-Cube | Ec-Cube | from 3.0.0 before 3.0.18 from 4.0.0 through 4.1.1 Version 3.0.18 |