Medium severity · published Mar 25, 2020
CVE-2020-10966
In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim…
6.5
CVSS
1.9%
EPSS
No
On KEV
Description
In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads to account takeover because the victim receives a reset URL containing an attacker-controlled server name.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
Control Panel · Hestiacp
before 1.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-10966
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-10966
Exploit
https://github.com/hestiacp/hestiacp/issues/748
Third Party Advisory
https://github.com/hestiacp/hestiacp/releases/tag/1.1.1
Patch
https://github.com/serghey-rodin/vesta/commit/c3c4de43d6701560f604ca7996f717b08e3d7d1d
More from Control Panel
9.8
CVE-2021-3797
hestiacp is vulnerable to Use of Wrong Operator in String Comparison
8.8
CVE-2025-30007
HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management
8.8
CVE-2022-2636
Code Injection in hestiacp/hestiacp
8.8
CVE-2022-2550
OS Command Injection in hestiacp/hestiacp
8.8
CVE-2022-1509
Command Injection Vulnerability in hestiacp/hestiacp