Executive Summary

This vulnerability in Webmin 2.510 is a Host Header Injection in the password reset functionality. The reset link sent to users is created using the HTTP Host header. An attacker can manipulate this Host header to insert a malicious domain into the reset email. If a user clicks on this manipulated link, the attacker can intercept the reset token and gain full control of the user's account.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows an attacker to intercept password reset tokens by sending users a reset link with a malicious domain. This can lead to the attacker gaining full control over the victim's account, potentially compromising sensitive information and access.

Useful 0 Not Useful 0