Host Header Injection Vulnerability in Croogo by Croogo
CVE-2024-29643

9.1CRITICAL

Key Information:

Vendor

Croogo

Status
Croogo
Vendor
CVE Published:
18 April 2025

What is CVE-2024-29643?

An attacker can exploit a vulnerability in Croogo version 3.0.2 that allows for host header injection through the feed.rss component. This flaw could potentially lead to various security risks, including the manipulation of web application behavior and the compromise of server integrity. It is crucial for users of Croogo to review and mitigate this vulnerability to safeguard their systems.

References

https://medium.com/@christbowel6/cve-2024-29643-host-head...

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.
CVE-2024-29643 : Host Header Injection Vulnerability in Croogo by Croogo