CVE-2020-27687

2020-12-1818:27:23

mitre

www.cve.org

8.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.1%

JSON

ThingsBoard before v3.2 is vulnerable to Host header injection in password-reset emails. This allows an attacker to send malicious links in password-reset emails to victims, pointing to an attacker-controlled server. Lack of validation of the Host header allows this to happen.