Description
CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | indico | < 2.3.4 | 2.3.4 | GHSA-wgpj-7c2j-vfjm |
High · 7.5
CVE-2021-30185
EUVD-2021-0101GHSA-wgpj-7c2j-vfjmPYSEC-2021-18
Indico Tampering with links (e.g. password reset) in sent emails
Published Apr 7, 2021 · Updated Aug 3, 2024 · Assigned by mitre