CVE-2020-27687

Published December 18th, 2020

View on NVD ↗

CVSS v3

8.8

HIGH

CVSS v2

6.8

MEDIUM

Affected

PROJECT

Description

ThingsBoard before v3.2 is vulnerable to Host header injection in password-reset emails. This allows an attacker to send malicious links in password-reset emails to victims, pointing to an attacker-controlled server. Lack of validation of the Host header allows this to happen.

thingsboard/thingsboard

Open-source IoT Platform - Device management, data collection, processing and visualization.

GitHub

21.9K