Unrated

Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send emai...

CVE-2025-27913 First seen on SecPulse Mar 10, 2025

Original description The description as published by the source.

Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

References

advisory github.com
advisory nvd.nist.gov
web passbolt.com

Key facts

Severity: Unrated
Published: Mar 10, 2025
First seen on SecPulse: Mar 10, 2025
CWE: CWE-348

NVD OSV

Detection sources

OSV.dev (Open Source Vulnerabilities)Oct 20, 20:08