Impact
What kind of vulnerability is it? Who is impacted?
Instances relying on an allow-listed reset URL are vulnerable to an HTML injection attack through the use of query parameters in the reset URL.
Patches
Has the problem been patched? What versions should users upgrade to?
The problem has been resolved and released under version 9.23.0. People relying on a custom password reset URL should upgrade to 9.23.0 or later, or remove the custom reset url from the configured allow list.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Disable the custom reset URL allow list.
References
Are there any links users can visit to find out more?
#17120
#17119
Impact
What kind of vulnerability is it? Who is impacted?
Instances relying on an allow-listed reset URL are vulnerable to an HTML injection attack through the use of query parameters in the reset URL.
Patches
Has the problem been patched? What versions should users upgrade to?
The problem has been resolved and released under version 9.23.0. People relying on a custom password reset URL should upgrade to 9.23.0 or later, or remove the custom reset url from the configured allow list.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
Disable the custom reset URL allow list.
References
Are there any links users can visit to find out more?
#17120
#17119