Description
JUNG Smart Visu Server 1.1.1050 contains a request header manipulation vulnerability that allows unauthenticated attackers to override request URLs by injecting arbitrary values in the X-Forwarded-Host header. Attackers can manipulate proxied requests to generate tainted responses, enabling cache poisoning, potential phishing, and redirecting users to malicious domains.
Problem types
Improper Neutralization of HTTP Headers for Scripting Syntax
Product status
1.0.905
1.0.832
1.0.830
Credits
LiquidWorm as Gjoko Krstic of Zero Science Lab
References
www.zeroscience.mk/en/vulnerabilities/ZSL-2026-5970.php (Zero Science Lab Vulnerability Advisory)
www.vulncheck.com/...on-of-http-headers-for-scripting-syntax (VulnCheck Advisory: JUNG Smart Visu Server - Improper Neutralization of HTTP Headers for Scripting Syntax)