CVE-2024-23648

Summary

CVE-2024-23648 is a vulnerability affecting Pimcore's Admin Classic Bundle, which provides a backend user interface. Before version 1.2.3, the password reset feature sent users an email with a URL containing a token to reset their passwords. Malicious actors could exploit this vulnerability by intercepting the email and manipulating the "Host" HTTP header to redirect users to their own malicious websites. If a user clicked on the link, the attacker would obtain the sensitive reset token and take over the user's account. With version 1.2.3, this issue has been resolved.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.