{"id":"CVE-2024-29643","details":"An issue in croogo v.3.0.2 allows an attacker to perform Host header injection via the feed.rss component.","aliases":["GHSA-847x-x4jg-6gf4"],"modified":"2026-08-12T03:51:48.286392699Z","published":"2025-04-18T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29643.json"},"references":[{"type":"WEB","url":"https://medium.com/@christbowel6/cve-2024-29643-host-header-injection-in-croogo-v3-0-2-0aded525f574"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29643.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29643"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/croogo/croogo","events":[{"introduced":"7b64bf6643be8b334551444cdb4293953fe2d3d3"},{"last_affected":"7b64bf6643be8b334551444cdb4293953fe2d3d3"}],"database_specific":{"extracted_events":[{"introduced":"3.0.2"},{"last_affected":"3.0.2"}],"source":"CPE_STRING","cpe":"cpe:2.3:a:croogo:croogo:3.0.2:*:*:*:*:*:*:*"}}],"versions":["3.0.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-29643.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"}]}