Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-29933

CVE-2022-29933: Improper account password reset in Craft CMS

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-29933
GHSA ID
GHSA-5cjr-78cq-3wrg
EPSS Score
0.84241%
CWE
CWE-640
Published
5/10/2022
Updated
2/1/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
craftcms/cmscomposer< 3.7.363.7.36

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability occurs in the password reset email generation endpoint (/admin/actions/users/send-password-reset-email). The UsersController's sendPasswordResetEmailAction is responsible for processing reset requests. It improperly trusts the X-Forwarded-Host header when constructing password reset URLs, allowing attackers to poison the link's domain. This matches the described attack vector where header manipulation leads to token leakage. While exact code isn't available, Craft CMS's MVC structure and the documented attack pattern strongly indicate this controller action as the vulnerable component.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*r**t *MS t*rou** *.*.** *llows * r*mot* un*ut**nti**t** *tt**k*r, w*o knows *t l**st on* v*li* us*rn*m*, to r*s*t t** ***ount's p*sswor* *n* t*k* ov*r t** ***ount *y provi*in* * *r**t** *TTP *****r to t** *ppli**tion w*il* usin* t** p*sswor* r*s*t *

Reasoning

T** vuln*r**ility o**urs in t** p*sswor* r*s*t *m*il **n*r*tion *n*point (/**min/**tions/us*rs/s*n*-p*sswor*-r*s*t-*m*il). T** Us*rs*ontroll*r's s*n*P*sswor*R*s*t*m*il**tion is r*sponsi*l* *or pro**ssin* r*s*t r*qu*sts. It improp*rly trusts t** X-*or