CVE-2020-36948
CRITICALVestaCP 0.9.8-26 - Incorrect Authorization via LoginAs Session Token Manipulation
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2020-36948. PoCs published by Vulnerability-Lab.
AI-analyzed exploit summary This exploit demonstrates an insufficient session validation vulnerability in VestaCP 0.9.8-26, allowing remote attackers to bypass authentication by manipulating the 'token' parameter in the 'LoginAs' module. The PoC shows how an attacker can access user or admin accounts without proper authorization.
Description
VestaCP 0.9.8-26 contains a session token vulnerability in the LoginAs module that allows remote attackers to manipulate authentication tokens. Attackers can exploit insufficient token validation to access user accounts and perform unauthorized login requests without proper administrative permissions.
Exploits (1)
This exploit demonstrates an insufficient session validation vulnerability in VestaCP 0.9.8-26, allowing remote attackers to bypass authentication by manipulating the 'token' parameter in the 'LoginAs' module. The PoC shows how an attacker can access user or admin accounts without proper authorization.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H