CVE-2024-42914

CVE-2024-42914 is a critical host header injection vulnerability in the forgot password functionality of ArrowCMS version 1.0.0. An attacker can manipulate the host header in a password reset request, redirecting the reset link to an attacker-controlled server and subsequently stealing the password reset token. This allows for unauthorized password resets of other user accounts. Rated with a CVSS score of 9.1 (CRITICAL), this vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, leading to high confidentiality and integrity impacts. While the EPSS score is low, indicating a low probability of exploitation in the wild, the FAUCET Risk Score is high at 72/100. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are also minimal, suggesting a lack of widespread attention at this time.