Executive brief
CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link.
Affected products
- PyPI indico
Junglewise Threat Intelligence
CVE-2021-30185: PYSEC-2021-18 - CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link.
CVE-2021-30185 · Severity: low · CVSS 3.1 · Published 2021-04-07
Technologies: indico (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1461 - Indico vulnerable to Cross-Site Scripting via LaTeX math code
- PYSEC-2026-1460 - Indico may disclose unauthorized user details access via legacy API
- PYSEC-2026-1462 - Indico vulnerability allows attackers to bulk dump user details
- PYSEC-2026-1459 - Indico Insecure Access
- PYSEC-2026-2184 - Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In versions prior to 3.3.12