CVE-2025-63828
CVE-2025-63828
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection.
CVSS 6.1 · Medium · EPSS 0.2%
- Published
- Updated
Stack: php
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
backdrop/backdrop Packagist
- Versions
- 1.13.2-rc1
- 1.13.2-rc2
- 1.17.3
- 1.18.3
- 1.19.1
- 1.20.3
- 1.21.0
- 1.21.1
- 1.21.3
- 1.21.4
- 1.22.1
- 1.22.2
- 1.27.0
- 1.28.0
- 1.29.0
- 1.30.0
- 1.30.2
- 1.31.0
- 1.32.0
- Affected ranges
- ECOSYSTEM: ≤ 1.32.0
No fix published