CVE-2024-42915

Published: Aug 23, 2024Modified: Jun 17, 2026Deferred

8.0

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.1 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This will allow attackers to arbitrarily reset other users' passwords and compromise their accounts.

Related CWEs

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

References (2)

https://github.com/debashish-choudhury/staff-appraisal-system/

Source: cve@mitre.org

https://github.com/soursec/CVEs/tree/main/CVE-2024-42915

Source: cve@mitre.org

Timeline

No history available yet.