CVE-2025-27913

7.5HIGH

Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attack

Publicado: 3/10/2025Actualizado: 6/19/2025
Ver en NVDVer en MITRE

Descripción

Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header.

Análisis IAImpulsado por IA

Productos Afectados

passboltpassbolt_api

Referencias