CVE-2021-25994

    Dashboard / Vulnerabilities / CVE-2021-25994

    CVE-2021-25994

    Published: 3 Jan 2022Last Modified: 9 Jul 2026

    Summary:

    Details: In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.

    References: https://github.com/userfrosting/UserFrosting/commit/796dd78757902435d1bd286415feea78098e45ba, https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25994

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- baa77a08a8d23d73b0dbbd9ea7b370b601a5fd9e
    Fixed -15d713a1fa2e9a67000b2a9a9413473f5c51da4d

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-25994 | CVE-DB