Yüksek CVSS 8.2
CVE-2025-61536: CVE-2025-61536: güvenlik açığı
Açıklama (NVD)
FelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset (magic) links using the untrusted `req.headers.host` header and forces the `http://` scheme. An attacker who can control the `Host` header (or exploit a misconfigured proxy/load-balancer that forwards the header unchanged) can cause reset links to point to attacker-controlled domains or be delivered via insecure HTTP, enabling token theft, phishing, and account takeover.
Özet bilgiler
- CVSS v3.1
- 8.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L - EPSS
- %0,43 (yüzdelik 38)
- CWE
- CWE-620
- Yama
- Yok / bilinmiyor