CVE-2022-33011
Known vulnerable to account takeover via host header injection attack in v1.3.1
Known v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover via a host header injection attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Known v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover via a host header injection attack.
- Record
CVE-2022-33011- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-74
- Updated
- 2026-11-02
CVE List No score
Known v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover via a host header injection attack.
- Record
CVE-2022-33011- Updated
- 2026-11-02
EUVDEUVD-2022-6381 No score
Known v1.3.1+2020120201 was discovered to allow attackers to perform an account takeover via a host header injection attack.
- Record
EUVD-2022-6381- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p757-4v3p-j74f
Known vulnerable to account takeover via host header injection attack in v1.3.1
Known v1.3.1 was discovered to allow attackers to perform an account takeover via a host header injection attack.
The researcher report indicates that versions 1.3.1 and prior are vulnerable. Version 1.2.2 is the last version tagged on GitHub and in Packagist, and development related to the 1.3.x branch is currently on the dev branch of the idno/known repository.
- Record
GHSA-p757-4v3p-j74f- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
OSVGHSA-p757-4v3p-j74f
Known vulnerable to account takeover via host header injection attack in v1.3.1
Known v1.3.1 was discovered to allow attackers to perform an account takeover via a host header injection attack.
The researcher report indicates that versions 1.3.1 and prior are vulnerable. Version 1.2.2 is the last version tagged on GitHub and in Packagist, and development related to the 1.3.x branch is currently on the dev branch of the idno/known repository.
- Record
GHSA-p757-4v3p-j74f- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
idno/knownPackagist |
through 1.3.1 | None known |
idno/knownPackagist |
through 1.3.1, plus listed versions 1.0.01.0.0-rc.11.0.0-rc.31.2.2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-33011 is a high vulnerability (CVSS 8.8) in Withknown Known, published July 8, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.54%, the 75th percentile. No source names a fixed version.
References
github.com/idno/known
pethuraj.com/blog/how-i-earned-800-for-host-header-injection-vulnerability
blog.jitendrapatro.me/multiple-vulnerabilities-in-idno-known-php-cms-software
nvd.nist.gov/vuln/detail/CVE-2022-33011