{"id":"CVE-2022-38796","aliases":["EUVD-2022-6693","GHSA-4r4f-jrvw-h727"],"status":"published","title":"Feehi CMS host header injection vulnerability","description":"A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header. This can be exploited by abusing password reset emails.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00614,"percentile":0.49706,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-74"],"published":"2022-09-14T14:18:09Z","modified":"2026-10-28T02:30:34Z","affected":[{"source":"ghsa","ecosystem":"Packagist","package":"feehi/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.1.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"feehi/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.1.1"}]}],"versions":["0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.8","0.0.9","0.1.0","0.1.1","0.1.2","0.1.3","1.0.0-alpha3","1.0.0alpha1","1.0.0alpha2","1.0.0beta1","1.0.0beta2","1.0.0beta3","1.0.0rc1","1.0.0rc2","2.0.0","2.0.1","2.0.2","2.0.3","2.0.4","2.0.4.1","2.0.5","2.0.5.1","2.0.6","2.0.7","2.0.7.1","2.0.8","2.0.8.1","2.1.0","2.1.0-beta","2.1.0-beta2","2.1.0.1","2.1.0.2","2.1.1"]}],"products":[{"vendor":"feehi","product":"feehi_cms"}],"references":[{"url":"https://www.youtube.com/watch?v=k8dp0FJnSsI","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-38796","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4r4f-jrvw-h727"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/38xxx/CVE-2022-38796.json","tags":["advisory"]},{"url":"https://github.com/liufee/cms","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-38796","description":"A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header. This can be exploited by abusing password reset emails.","status":"published","published":"2022-09-14T14:18:09Z","modified":"2024-08-03T11:02:14.677Z","updated_at":"2026-11-02T14:34:37.272373Z"}],"euvd":[{"id":"EUVD-2022-6693","description":"A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header. This can be exploited by abusing password reset emails.","status":"published","published":"2022-09-14T14:18:09Z","modified":"2024-08-03T11:02:14Z","updated_at":"2026-11-03T03:25:21.94292Z"}],"ghsa":[{"id":"GHSA-4r4f-jrvw-h727","title":"Feehi CMS host header injection vulnerability","description":"A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header. This can be exploited by abusing password reset emails.","status":"published","published":"2022-09-15T00:00:19Z","modified":"2023-07-07T19:01:25Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:36:56.605555Z"}],"nvd":[{"id":"CVE-2022-38796","description":"A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header. This can be exploited by abusing password reset emails.","status":"published","published":"2022-09-14T15:15:11.407Z","modified":"2026-06-17T04:57:11.277Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:07:27.631109Z"}],"osv":[{"id":"GHSA-4r4f-jrvw-h727","title":"Feehi CMS host header injection vulnerability","description":"A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header. This can be exploited by abusing password reset emails.","status":"published","published":"2022-09-15T00:00:19Z","modified":"2024-02-16T08:11:16.590187Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T15:46:37.528068Z"},{"id":"CVE-2022-38796","description":"A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header. This can be exploited by abusing password reset emails.","status":"published","published":"2022-09-14T14:18:09Z","modified":"2026-10-28T02:30:34.572385213Z","updated_at":"2026-11-02T15:44:26.53798Z"}]}}