What’s Vulnerable › Vulnerabilities

CVE-2021-38290

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-08-09 · updated 2026-06-17
• Weakness: CWE-74

Description

A host header attack vulnerability exists in FUEL CMS 1.5.0 through fuel/modules/fuel/config/fuel_constants.php and fuel/modules/fuel/libraries/Asset.php. An attacker can use a man in the middle attack such as phishing.

Affected products

• Thedaylightstudio Fuel Cms: through 1.5.0

References

• https://github.com/daylightstudio/FUEL-CMS/commit/8a0d88ad6869623c90e24b3b2ea33352049d39a7
• https://github.com/daylightstudio/FUEL-CMS/issues/580
• https://github.com/daylightstudio/FUEL-CMS/commit/8a0d88ad6869623c90e24b3b2ea33352049d39a7
• https://github.com/daylightstudio/FUEL-CMS/issues/580

Get alerted when CVE-2021-38290 or the next vulnerability affects your stack