Input validation error in laravel - CVE-2017-9303
Published: May 30, 2017 / Updated: August 8, 2020
Vulnerability identifier: #VU38931
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2017-9303
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Laravel LLC
Affected software:
laravel
laravel
Detailed vulnerability description
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host.
How to mitigate CVE-2017-9303
Install update from vendor's website.