CVE-2021-30185: CERN Indico Password Reset Link Host Header Injection
Summary
CVE-2021-30185: CERN Indico before 2.3.4 can use an attacker-supplied Host header in a password reset link. Affects indico versions < 2.3.4. Fixed in 2.3.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CERN Indico is an open-source web application used for event management. It provides functionalities for organizing conferences, workshops, and meetings. The application is widely used by academic institutions and research organizations. Indico is available on the Python Package Index (PyPI) and can be installed using pip. This vulnerability affects versions of Indico prior to 2.3.4.
Vulnerability Detail
The vulnerability in CERN Indico allows an attacker to manipulate the Host header in a password reset link. By supplying a malicious Host header, an attacker can potentially redirect the password reset link to a different domain under their control. This can lead to various attacks, such as phishing or capturing sensitive information. The vulnerability was identified as PYSEC-2021-18 and has been assigned the CVE identifier CVE-2021-30185.
How To Fix
Latest published version: 3.3.14 as of 22 Oct 2026
pip install --upgrade "indico==3.3.14"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.4
This is the first release that contains the fix.
pip install --upgrade "indico==2.3.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in CERN Indico allows an attacker to manipulate the Host header in a password reset link, potentially leading to various attacks. To mitigate this vulnerability, it is crucial to upgrade to version 2.3.4 or later of CERN Indico. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for indico →
FAQ
CERN Indico is an open-source web application used for event management. It is widely used by academic institutions and research organizations to organize conferences, workshops, and meetings.
The vulnerability allows an attacker to manipulate the Host header in a password reset link, potentially redirecting it to a malicious domain. This can lead to various attacks, such as phishing or capturing sensitive information.
To fix this vulnerability, it is recommended to upgrade to version 2.3.4 or later of CERN Indico. This version includes a fix for the Host header manipulation issue. Users can update their installation by running the command 'pip install --upgrade indico'.
No, only versions prior to 2.3.4 are affected by this vulnerability. It is recommended to upgrade to the latest version to ensure the security of your installation.
No specific workaround has been provided for this vulnerability. It is recommended to upgrade to the fixed version as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for indico.
