CVE-2020-27687

ThingsBoard before v3.2 is vulnerable to Host header injection in password-reset emails. The root cause is lack of validation of the Host header, enabling an attacker to embed a malicious link in a password-reset email that points to an attacker-controlled server. Impact per sources is high confi...