漏洞总结：Password Reset Link Sent Over Unsecured HTTP 漏洞概述 漏洞名称：Password Reset Link Sent Over Unsecured HTTP 漏洞描述：在 中，密码重置功能通过不安全的 HTTP 协议发送重置链接，而不是 HTTPS。这可能导致中间人攻击（MITM），攻击者可以在同一网络中拦截重置链接，从而未经授权访问受害者账户。 CVSS 评分：7.5 / 10 CVSS 向量：CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N 影响范围 受影响版本： 修复版本： 攻击向量：网络 攻击复杂度：高 攻击要求：存在 特权要求：无 用户交互：活跃 机密性影响：高 完整性影响：高 可用性影响：高 修复方案 缓解措施：确保所有敏感 URL，尤其是密码重置链接，通过安全的 HTTPS 端点生成和传输。 最佳实践： - 在所有密码相关电子邮件中使用 HTTPS。 - 实施 HSTS（HTTP 严格传输安全）以强制安全连接。 POC 代码 ```plaintext http://url6444.mail.flowiseai.com/ul/click?pn=001_wa38qBQxD8ACvFO3KPOEqb4nvV9B-2FRjNXRYD9y9CKM622C9ChG4-2BvQy73TycKl-2B5N2d6aQy4vIU7-2FJsX6GtKDHX2K4mp-2B-2FhMDPBX-2HRj8G7vM-2F5M1+1PQl63P5F4dGn2OW384A4xMC-P2sy0v2V1N6N9W8dV8ACxMC-3017EV-DW2bNY7bGf0bFNWv0z-2B4mN9y0rBFP-2B1hPQ1C6yX4Y2C9Y4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4aA4wX4