Threat Investigation
Request a demo

CVE-2020-27687

High

Description

ThingsBoard before v3.2 is vulnerable to Host header injection in password-reset emails. This allows an attacker to send malicious links in password-reset emails to victims, pointing to an attacker-controlled server. Lack of validation of the Host header allows this to happen.

SeverityHigh
CVSS8.8
Exploit probability—
ProductThingsboard
PublishedDec 18, 2020
First seenDec 18, 2020

How to fix

Update
  • thingsboard thingsboard3.2 or later

Affected products

ProductAffected versionsFixed in
thingsboard thingsboardv < 3.23.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.