https://vulnerability.circl.lu/sightings/feed 2026-05-31T12:23:38.622347+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/c06caf6f-b19a-4fba-b264-c049b8fae781/export 2026-05-31T12:23:38.956516+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "c06caf6f-b19a-4fba-b264-c049b8fae781", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-41801", "type": "seen", "source": "https://t.me/cvedetector/1634", "content": "{\n \"Source\": \"CVE FEED\",\n \"Title\": \"CVE-2024-41801 - OpenProject Host Header Redirection Vulnerability\", \n \"Content\": \"CVE ID : CVE-2024-41801 \nPublished : July 25, 2024, 5:15 p.m. | 56\u00a0minutes ago \nDescription : OpenProject is open source project management software. Prior to version 14.3.0, using a forged HOST header in the default configuration of packaged installations and using the \"Login required\" setting, an attacker could redirect to a remote host to initiate a phishing attack against an OpenProject user's account. This vulnerability affects default packaged installation of OpenProject without any additional configuration or modules on Apache (such as mod_security, manually setting a host name, having a fallthrough VirtualHost). It might also affect other installations that did not take care to fix the HOST/X-Forwarded-Host headers. Version 14.3.0 includes stronger protections for the hostname from within the application using the HostAuthorization middleware of Rails to reject any requests with a host name that does not match the configured one. Also, all generated links by the application are now ensured to use the built-in hostname. Users who aren't able to upgrade immediately may use mod_security for Apache2 or manually fix the Host and X-Forwarded-Host headers in their proxying application before reaching the application server of OpenProject. Alternatively, they can manually apply the patch to opt-in to host header protections in previous versions of OpenProject. \nSeverity: 4.7 | MEDIUM \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n \"Detection Date\": \"25 Jul 2024\",\n \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-25T20:15:42.000000Z"} 2024-07-25T20:15:42+00:00