CVE-2020-27687

    Dashboard / Vulnerabilities / CVE-2020-27687

    CVE-2020-27687

    Published: 18 Dec 2020Last Modified: 7 Aug 2026

    Summary:

    Details: ThingsBoard before v3.2 is vulnerable to Host header injection in password-reset emails. This allows an attacker to send malicious links in password-reset emails to victims, pointing to an attacker-controlled server. Lack of validation of the Host header allows this to happen.

    References: https://github.com/thingsboard/thingsboard/commits/master, https://gist.github.com/vin01/26a8bb13233acd9425e7575a7ad4c936

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -d293420ce8b30d5f710ecfdc7dd27429ff6171f8

    Affected versions

    v2.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2020-27687 | CVE-DB