CVE-2020-36948

EUVD-2020-30863
VestaCP 0.9.8-26 contains a session token vulnerability in the LoginAs module that allows remote attackers to manipulate authentication tokens. Attackers can exploit insufficient token validation to access user accounts and perform unauthorized login requests without proper administrative permissions.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheckCNA
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 46%
Common Weakness Enumeration
References
https://vestacp.com/
https://www.exploit-db.com/exploits/49219
https://www.vulncheck.com/advisories/vestacp-loginas-insufficient-session-validation
https://www.vulnerability-lab.com/get_content.php?id=2240
https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.
https://www.exploit-db.com/exploits/49219
https://www.vulnerability-lab.com/get_content.php?id=2240
https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.