Concrete CMS · Report #301592
Host Header Injection allow HiJack Password Reset Link
Duplicatestatus
lowseverity
1upvotes
12 Jan 2018disclosed
Summary
The issue reported in #59666 and in #226659 is still applicable as originally reported, however it is tracked as an "informative" issue that can be resolved simply with proper webserver configuration or by configuring concrete5 to force a "canonical url".
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.