CVE-2021-38751

A HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php. A modified HTTP header can change links on the webpage to an arbitrary value, leading to a possible attack vector for MITM.

Score

CVSS 3.1 4.3 Medium

Status

Modified - cve@mitre.org

Published

2021-08-16

Last modified

2024-08-04

Weaknesses

CWE-116

Affected products

• Exponentcms (Exponentcms)

References

• https://github.com/exponentcms/exponent-cms/issues/1544