CyberRota Analysis
AI-GeneratedBunkerWeb versions prior to 1.6.12 and BunkerWeb PRO versions prior to 0.57 have a vulnerability in the Host header handling within the UI and API, which fails to properly validate user input. This allows low-privileged authenticated users to escalate their privileges, potentially compromising the confidentiality, integrity, and availability of the BunkerWeb instance. Organizations using affected versions should prioritize updating to the latest releases to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). Prior to BunkerWeb 1.6.12 and BunkerWeb PRO 0.57, authenticated Host header handling in the BunkerWeb UI and API improperly validated and neutralized user-controlled input in a configuration-dependent path, allowing a low-privileged authenticated user to escalate privileges and affect confidentiality, integrity, and availability of the BunkerWeb instance. This issue is fixed in BunkerWeb version 1.6.12 and BunkerWeb PRO version 0.57.