CVE-2023-38877 is a high-severity host header injection vulnerability affecting gugoan's Economizzer v0.9-beta1 and commit 3730880. An attacker can exploit this by sending a crafted host header during a password reset request, redirecting password reset links to an attacker-controlled server and compromising the reset token. This allows for unauthorized password resets of other users, leading to high impact on confidentiality, integrity, and availability. Despite its high CVSS score of 8.8, there is currently no evidence of active exploitation, public exploit code, or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
0.9CPE matchmatch criteria | cpe:2.3:a:economizzer:economizzer:0.9:beta1:*:*:*:wordpress:*:* | ||
april_2023CPE matchmatch criteria | cpe:2.3:a:economizzer:economizzer:april_2023:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.