CVE-2025-63828
BaseFortify
Publication date: 2025-11-18
Last updated on: 2025-11-24
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| backdropcms | backdrop_cms | 1.32.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-601 | The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Host Header Injection in Backdrop CMS version 1.32.1. It allows attackers to manipulate the Host header in password reset requests, which can cause the system to redirect users to malicious domains and potentially enable session hijacking through cookie injection.
How can this vulnerability impact me? :
The vulnerability can lead to users being redirected to malicious websites, which may result in phishing attacks or malware exposure. Additionally, attackers may hijack user sessions by injecting cookies, compromising user accounts and sensitive information.