Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This may allow an attacker to reset other users' passwords and take over their accounts.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
CouchAuth 安全漏洞
Vulnerability Description
CouchAuth是一个身份验证API。 CouchAuth 0.20.0版本及之前版本存在安全漏洞，该漏洞源于通过在忘记密码请求中发送特制的主机标头，可以向用户发送密码重置链接，一旦点击该链接，就会使攻击者控制服务器，从而泄露密码重置令牌。
CVSS Information
N/A
Vulnerability Type
N/A