CVE-2020-10966

In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover…

published March 25, 2020

CVSS
—
EPSS
2%
Percentile
79.0
In the wild
Unconfirmed
What it is

In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01853 · 79.0th percentile
Published
2020-03-25T22:50Z
EPSS history
Timeline
  • 25 MAR 22:50Z
    In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover…
    cvelistv5