medium6.5
CVE-2024-42903
A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password …
Impact
A Host header injection vulnerability in the password reset function of LimeSurvey v.6.6.1+240806 and before allows attackers to send users a crafted password reset link that will direct victims to a malicious domain.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Limesurvey | Limesurvey | through 6.6.1\+240806 |