POJIA破甲
地图 / Self-DoS due to template injection via email field in password reset form on access.acronis.com

Self-DoS due to template injection via email field in password reset form on access.acronis.com

代码执行 / Unlabeled / #1265344

厂商
Acronis
严重程度
低危
赏金
—
弱点
Unlabeled
研究员
@sudo_bash
披露日期
2022-05-03
资产
*.acronis.com
CVE
—

该报告还没有中文解读。

原文摘录

摘自原文(487 字符中的一小部分)
Summary HI acronis security team , how are you I hope everyone is OK in the other side of the screen . I found Template Injection in [https://access.acronis.com/reset_password/new] via the mail input .

默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Acronis 所有。

时间线

  • 报告提交
  • 公开披露
阅读 HackerOne 原文 ↗作者 @sudo_bash · 版权归作者与 Acronis 所有

同类报告

CVE-2020-8913 - Persistent arbitrary code execution in Android's Google Play Core Library: details, explanation and the PoCGoogle · —Remote code execution [CVE-2023-36845]MTN Group · 2024-10-09Remote Code Execution on Proxy Service (as root)██████ · —XSS Vulnerability on Pressable/Atomic Hosting Platform via unescaped admin notices leads to code executionAutomattic · 2026-02-18Remote Code Execution via unsafe usage of `reply.view({ raw })` in @fastify/view (EJS template engine)Fastify · 2025-05-28Reflected XSS and Server Side Template Injection in all HubSpot CMSesHubSpot Inactive · —