Host Header Injection Vulnerability in Greenbone Security Assistant and Greenbone OS
CVE-2018-25016

9.8CRITICAL

Key Information:

Vendor

Greenbone

Status
Greenbone Os
Greenbone Security Assistant
Vendor
CVE Published:
21 June 2021

What is CVE-2018-25016?

Greenbone Security Assistant prior to version 7.0.3 and Greenbone OS prior to version 5.0.0 are susceptible to host header injection, which may allow attackers to manipulate server behavior, potentially leading to unintended access or exposure of sensitive information. It is critical for users of these products to apply the necessary updates to mitigate this risk.

References

https://github.com/greenbone/gsa/pull/318
x_refsource_MISC
https://github.com/greenbone/gsa/releases/tag/v7.0.3
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.