CVE-2025-61541
BaseFortify
Publication date: 2025-10-16
Last updated on: 2025-11-06
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| webmin | webmin | 2.510 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Webmin 2.510 is a Host Header Injection in the password reset functionality. The reset link sent to users is created using the HTTP Host header. An attacker can manipulate this Host header to insert a malicious domain into the reset email. If a user clicks on this manipulated link, the attacker can intercept the reset token and gain full control of the user's account.
How can this vulnerability impact me? :
If exploited, this vulnerability allows an attacker to intercept password reset tokens by sending users a reset link with a malicious domain. This can lead to the attacker gaining full control over the victim's account, potentially compromising sensitive information and access.