CVE-2025-27913

7.5HIGH

Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attack

Veröffentlicht: 3/10/2025Aktualisiert: 6/19/2025
Auf NVD ansehenAuf MITRE ansehen

Beschreibung

Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header.

KI-AnalyseKI-gestützt

Betroffene Produkte

passboltpassbolt_api

Referenzen