CVE-2020-10966

Published March 25th, 2020

View on NVD ↗

CVSS v3

6.5

MEDIUM

CVSS v2

4.3

MEDIUM

Affected

PROJECTS

Description

In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name.

outroll/vesta

VESTA Control Panel

GitHub

3.07K

hestiacp/hestiacp

Hestia Control Panel | A lightweight and powerful control panel for the modern web.

GitHub

4.36K