CVE-2020-27687

Katalog CVE

CVSS 8.8 · High EPSS 1,5%

Kerentanan Improper Input Validation pada thingsboard. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

ThingsBoard before v3.2 is vulnerable to Host header injection in password-reset emails. This allows an attacker to send malicious links in password-reset emails to victims, pointing to an attacker-controlled server. Lack of validation of the Host header allows this to happen.

Rincian

Terbit di NVD

18 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 74,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/vin01/26a8bb13233acd9425e7575a7ad4c936 exploit · advisory pihak ketiga
• https://github.com/thingsboard/thingsboard/commits/master advisory pihak ketiga