CVE-2020-27687

2020-12-1819:15:14

Google

osv.dev

7 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.1%

JSON

ThingsBoard before v3.2 is vulnerable to Host header injection in password-reset emails. This allows an attacker to send malicious links in password-reset emails to victims, pointing to an attacker-controlled server. Lack of validation of the Host header allows this to happen.

CPENameOperatorVersion
thingsboardeq1.3.1
thingsboardeq1.2.1
thingsboardeq2.4
thingsboardeq2.0.1
thingsboardeq1.3
thingsboardeq2.1.2
thingsboardeq2.4.3
thingsboardeq1.1
thingsboardeq2.5
thingsboardeq2.4.2

Name	Operator	Version
thingsboard	eq	1.3.1
thingsboard	eq	1.2.1
thingsboard	eq	2.4
thingsboard	eq	2.0.1
thingsboard	eq	1.3
thingsboard	eq	2.1.2
thingsboard	eq	2.4.3
thingsboard	eq	1.1
thingsboard	eq	2.5
thingsboard	eq	2.4.2