CVE-2020-25901: 
Spiceworks Inventory vulnerability analysis and mitigation

A Host Header Injection vulnerability was discovered in Spiceworks version 7.5.7.0, identified as CVE-2020-25901. The vulnerability allows attackers to render arbitrary links that point to malicious websites through poisoned Host header webpages. The issue was discovered and disclosed in December 2020 (MITRE CVE, NVD).

The vulnerability exists because the application implicitly trusts the values of the 'Host' headers when this should be forbidden. This misconfiguration can lead to potential host header injection attacks and allows affected hosts to be used for domain fronting. The vulnerability has been assigned a CVSS v3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) (GitHub Vulnerability).

The vulnerability allows attackers to manipulate the Host header to redirect users to malicious websites. Additionally, affected hosts can be used by attackers to hide behind during various other attacks through domain fronting techniques (GitHub Vulnerability).

The vulnerability can be exploited by sending specially crafted HTTP requests with modified Host headers. The attack requires no authentication and can be initiated remotely, though it does require user interaction for successful exploitation (GitHub Vulnerability).