CVE-2021-38751
published 2021-08-16CVE-2021-38751: A HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php. A modified HTTP header can change links on the webpage to an…
PriorityP430medium4.3CVSS 3.1
AVNACLPRNUIRSUCNILAN
EXPLOIT
EPSS
2.47%
82.5th percentile
A HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php. A modified HTTP header can change links on the webpage to an arbitrary value, leading to a possible attack vector for MITM.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| exponentcms | exponentcms | < 2.6 | 2.6 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Nuclei
ExponentCMS <= 2.6 - Host Header Injection
nuclei·CVSS 4.3
CVE-2021-38751 [MEDIUM] ExponentCMS <= 2.6 - Host Header Injection
ExponentCMS <= 2.6 - Host Header Injection
An HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php. A modified HTTP header can change links on the webpage to an arbitrary value,leading to a possible attack vector for MITM.
Template:
id: CVE-2021-38751
info:
name: ExponentCMS <= 2.6 - Host Header Injection
author: dwisiswant0
severity: medium
description: An HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php. A modified HTTP header can change links on the webpage to an arbitrary value,leading to a possible attack vector for MITM.
impact: |
An attacker can manipulate the Host header to perform various attacks, including phishing, session hijacking, and cache poisoning.
remediation: |
Upgrade ExponentCMS to a version hi
No writeups or analysis indexed.
2021-08-16
Published