Severity
- CVSS 3.x
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/laravel/framework ↗ | |
| 7212b1e9620c36bf806e444f6931cf5f379c68ff through 7212b1e9620c36bf806e444f6931cf5f379c68ff | No fix listed |
Also listed as affected (2)
| |
| GIT github.com/laravel/laravel ↗ | |
| d9f54e3454b4cbbc7b614970c9f5d48e440f3957 through d9f54e3454b4cbbc7b614970c9f5d48e440f3957 | No fix listed |
Also listed as affected (2)
| |
Description
Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host.