BaseFortify

Publication date: 2025-10-16

Last updated on: 2026-02-02

Assigner: MITRE

Description

Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to reset a user's password.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-16

Last Modified

2026-02-02

Generated

2026-07-06

AI Q&A

2025-10-16

EPSS Evaluated

2026-07-05

NVD

CVE-2025-22381

Affected Vendors & Products

Vendor	Product	Version / Range
mongodb	mongodb	4.2
node.js	node.js	12.16
pm2	pm2	*
python	python	2.7
tid-lab	aggie	*
nginx	nginx	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-620	When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.

Attack-Flow Graph

Executive Summary

This vulnerability is a Host Header injection in Aggie version 2.6.1, specifically in the forgot password functionality. It allows an attacker to manipulate the Host Header to reset a user's password without authorization.

Impact Analysis

An attacker exploiting this vulnerability can reset passwords of users, potentially gaining unauthorized access to user accounts and compromising the security of the affected system.

Hi! I’m here to help you understand CVE-2025-22381. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70