Internet Routing Registry Daemon
Monthly
Host header injection in Internet Routing Registry daemon (IRRd) 4.4.0-4.4.4 and 4.5.0 allows remote attackers to redirect password reset and account creation confirmation links to attacker-controlled domains, enabling account takeover of IRR database maintainer accounts. Successfully exploited accounts can modify routing policy objects (RPSL) in the IRR database. EPSS score of 0.06% (18th percentile) indicates low predicted exploitation probability. Vendor patches available in versions 4.4.5 and 4.5.1.
Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Host header injection in Internet Routing Registry daemon (IRRd) 4.4.0-4.4.4 and 4.5.0 allows remote attackers to redirect password reset and account creation confirmation links to attacker-controlled domains, enabling account takeover of IRR database maintainer accounts. Successfully exploited accounts can modify routing policy objects (RPSL) in the IRR database. EPSS score of 0.06% (18th percentile) indicates low predicted exploitation probability. Vendor patches available in versions 4.4.5 and 4.5.1.
Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.