What is GHSA-847x-x4jg-6gf4?

GHSA-847x-x4jg-6gf4 is a security advisory published by GitHub Security Advisories with Medium severity. croogo Host header injection

Which CVE IDs does GHSA-847x-x4jg-6gf4 cover?

GHSA-847x-x4jg-6gf4 covers the following CVE IDs: CVE-2024-29643. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-847x-x4jg-6gf4?

GHSA-847x-x4jg-6gf4 affects 1 product, including: composer/croogo/croogo:\u003c= 3.0.2.

GHSA-847x-x4jg-6gf4Medium

croogo Host header injection

Vendor

GitHub Security Advisories

Published

April 21, 2025

Last Modified

April 23, 2025

🔗 CVE IDs covered (1)

CVE-2024-29643 →

📋 Description

An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component.

🎯 Affected products1

composer/croogo/croogo:<= 3.0.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-29643
https://medium.com/@christbowel6/cve-2024-29643-host-header-injection-in-croogo-v3-0-2-0aded525f574
https://github.com/croogo/croogo/issues/1005
https://github.com/advisories/GHSA-847x-x4jg-6gf4