{"id":"CVE-2017-9303","title":"Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers","published":"2017-05-29T18:29:00.173Z","updated":"2026-06-16T21:27:51.457Z","severity":"medium","cvssScore":6.1,"epss":0.00959,"epssPct":0.61967,"kev":false,"maturity":"none","actionScore":24,"primaryVendor":"laravel","primaryProduct":"laravel","cweId":"CWE-20","fixAvailable":true,"tags":["pre-auth","remote"],"epssDelta7":0,"summary":"Laravel 5.4.x before 5.4.22 does not properly constrain the host portion of a password-reset URL, which makes it easier for remote attackers to conduct phishing attacks by specifying an attacker-controlled host.","cvssVector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssVersion":"3.0","cvssSource":"nvd-primary","cweName":"Improper Input Validation","kevAdded":null,"kevDue":null,"kevRansomware":null,"source":"nvd","cna":"mitre","ssvc":null,"sources":{"cna":"2024-08-05T17:02:44.280Z","osv":"2026-11-13T03:18:18.039Z","epss":"2026-11-12","cna_seen":"2026-09-29T10:51:04.333Z"},"cvssCna":null,"hasPatchRef":false,"credits":[],"counts":{"exploitdb":0,"metasploit":0,"nuclei":0,"githubPoc":0},"products":[{"vendor":"laravel","product":"laravel","cpe":"cpe:2.3:a:laravel:laravel"}],"references":[{"url":"http://www.securityfocus.com/bid/98776","tags":"Third Party Advisory,VDB Entry"},{"url":"https://laravel-news.com/laravel-5-4-22-is-now-released-and-includes-a-security-fix","tags":"Vendor Advisory"}],"exploits":[],"analysis":null,"affectedVersions":[{"vendor":"laravel","product":"laravel","version":"5.4.0","vsi":null,"vse":null,"vei":null,"vee":null}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}