CVE-2020-36948
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Summary
VestaCP 0.9.8-26 contains a session token vulnerability in the LoginAs module that allows remote attackers to manipulate authentication tokens. Attackers can exploit insufficient token validation to access user accounts and perform unauthorized login requests without proper administrative permissions.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| VestaCP | VestaCP | 0.9.8-26 | affected |
Weaknesses
- CWE-863: Incorrect Authorization
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: poc
- Automatable: no
- Technical Impact: total
Additional References
- https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.
- https://www.exploit-db.com/exploits/49219
- https://www.vulnerability-lab.com/get_content.php?id=2240
References
- https://www.exploit-db.com/exploits/49219
- https://vestacp.com/
- https://www.vulnerability-lab.com/get_content.php?id=2240
- https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.
- https://www.vulncheck.com/advisories/vestacp-loginas-insufficient-session-validation
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.