CVE-2021-38290

Name of the Vulnerable Software and Affected Versions FUEL CMS versions 1.5.0

Description A host header attack issue exists due to the lack of special element neutralization in fuel/modules/fuel/config/fuel constants.php and fuel/modules/fuel/libraries/Asset.php. This can allow a remote attacker to impact the confidentiality, integrity, and availability of protected information. An attacker can use a man-in-the-middle attack, such as phishing.

Recommendations For FUEL CMS version 1.5.0, consider disabling access to the fuel/modules/fuel/config/fuel constants.php and fuel/modules/fuel/libraries/Asset.php files until a patch is available. Restrict access to these modules to minimize the risk of exploitation. Avoid using the fuel/modules/fuel/config/fuel constants.php and fuel/modules/fuel/libraries/Asset.php files in sensitive operations until the issue is resolved.