CVE-2025-27913CWE-348

Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email…

Low · published March 10, 2025

CVSS v4.0
2.1
EPSS
0%
Percentile
7.8
In the wild
Unconfirmed
What it is

Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email messages with a domain name taken from an attacker-controlled HTTP Host header.

The record
Technical detail
CVSS v4.0
2.1 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
EPSS
0.00187 · 7.8th percentile
Weakness
CWE-348 · Use of Less Trusted Source
Published
2025-03-10T00:00Z
EPSS history
Timeline
  • 10 MAR 00:00Z
    Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email…
    cvelistv5