BaseFortify

Publication date: 2025-11-18

Last updated on: 2025-11-24

Assigner: MITRE

Description

Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains and potential session hijacking via cookie injection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-18

Last Modified

2025-11-24

Generated

2026-07-06

AI Q&A

2025-11-18

EPSS Evaluated

2026-07-05

NVD

CVE-2025-63828

Affected Vendors & Products

Vendor	Product	Version / Range
backdropcms	backdrop_cms	1.32.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

This vulnerability is a Host Header Injection in Backdrop CMS version 1.32.1. It allows attackers to manipulate the Host header in password reset requests, which can cause the system to redirect users to malicious domains and potentially enable session hijacking through cookie injection.

Impact Analysis

The vulnerability can lead to users being redirected to malicious websites, which may result in phishing attacks or malware exposure. Additionally, attackers may hijack user sessions by injecting cookies, compromising user accounts and sensitive information.

Hi! I’m here to help you understand CVE-2025-63828. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70