Description
UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading to their server, and when responses are cached by shared proxies, subsequent administrators execute attacker-supplied code in their authenticated sessions.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
unopim unopim
Default version status: unaffected
2.0.0 to < 2.0.1affected2.1.0 to < 2.1.1affected
pkg:composer/unopim/unopimReferences
- https://github.com/unopim/unopim/commit/77e33618df5ba82fc9c9a32d137368e5bbe5ac9c ↗
- https://github.com/unopim/unopim/releases/tag/v2.0.1 ↗
- https://github.com/unopim/unopim/releases/tag/v2.1.1 ↗
- https://github.com/unopim/unopim/blob/v2.1.0/bootstrap/app.php#L24 ↗
- https://github.com/unopim/unopim/blob/v2.1.0/packages/Webkul/Admin/src/Resources/views/components/layouts/index.blade.php#L9 ↗
- https://github.com/unopim/unopim ↗
- https://www.vulncheck.com/advisories/unopim-2.0.0-before-2.0.1-and-2.1.0-before-2.1.1-cache-poisoning-via-x-forwarded-host ↗