CVE-2020-36948

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2020-36948", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-01-25T13:50:01.143Z", "datePublished": "2026-01-27T15:23:50.046Z", "dateUpdated": "2026-03-05T01:27:04.698Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-03-05T01:27:04.698Z"}, "datePublic": "2020-11-26T00:00:00.000Z", "title": "VestaCP 0.9.8-26 - 'LoginAs' Insufficient Session Validation", "descriptions": [{"lang": "en", "value": "VestaCP 0.9.8-26 contains a session token vulnerability in the LoginAs module that allows remote attackers to manipulate authentication tokens. Attackers can exploit insufficient token validation to access user accounts and perform unauthorized login requests without proper administrative permissions."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Incorrect Authorization", "cweId": "CWE-863", "type": "CWE"}]}], "affected": [{"vendor": "VestaCP", "product": "VestaCP", "versions": [{"version": "0.9.8-26", "status": "affected"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-26:*:*:*:*:*:*:*"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.7, "baseSeverity": "HIGH", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://www.exploit-db.com/exploits/49219", "name": "ExploitDB-49219", "tags": ["exploit"]}, {"url": "https://vestacp.com/", "name": "VestaCP Official Homepage", "tags": ["product"]}, {"url": "https://www.vulnerability-lab.com/get_content.php?id=2240", "name": "Vulnerability Lab Advisory", "tags": ["technical-description", "exploit"]}, {"url": "https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.", "name": "Benjamin Kunz Mejri Profile", "tags": ["vendor-advisory"]}, {"name": "VulnCheck Advisory: VestaCP 0.9.8-26 - 'LoginAs' Insufficient Session Validation", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/vestacp-loginas-insufficient-session-validation"}], "credits": [{"lang": "en", "value": "Vulnerability-Lab", "type": "finder"}], "x_generator": {"engine": "vulncheck"}}, "adp": [{"references": [{"url": "https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.", "tags": ["exploit"]}, {"url": "https://www.exploit-db.com/exploits/49219", "tags": ["exploit"]}, {"url": "https://www.vulnerability-lab.com/get_content.php?id=2240", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-27T21:07:57.516937Z", "id": "CVE-2020-36948", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T21:36:26.071Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2020-36948", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-27T21:07:57.516937Z"}}}], "references": [{"url": "https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.", "tags": ["exploit"]}, {"url": "https://www.exploit-db.com/exploits/49219", "tags": ["exploit"]}, {"url": "https://www.vulnerability-lab.com/get_content.php?id=2240", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-27T21:08:06.821Z"}}], "cna": {"title": "VestaCP 0.9.8-26 - 'LoginAs' Insufficient Session Validation", "credits": [{"lang": "en", "type": "finder", "value": "Vulnerability-Lab"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "VestaCP", "product": "VestaCP", "versions": [{"status": "affected", "version": "0.9.8-26"}]}], "datePublic": "2020-11-26T00:00:00.000Z", "references": [{"url": "https://www.exploit-db.com/exploits/49219", "name": "ExploitDB-49219", "tags": ["exploit"]}, {"url": "https://vestacp.com/", "name": "VestaCP Official Homepage", "tags": ["product"]}, {"url": "https://www.vulnerability-lab.com/get_content.php?id=2240", "name": "Vulnerability Lab Advisory", "tags": ["technical-description", "exploit"]}, {"url": "https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M.", "name": "Benjamin Kunz Mejri Profile", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/vestacp-loginas-insufficient-session-validation", "name": "VulnCheck Advisory: VestaCP 0.9.8-26 - 'LoginAs' Insufficient Session Validation", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "VestaCP 0.9.8-26 contains a session token vulnerability in the LoginAs module that allows remote attackers to manipulate authentication tokens. Attackers can exploit insufficient token validation to access user accounts and perform unauthorized login requests without proper administrative permissions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "Incorrect Authorization"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-26:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-03-05T01:27:04.698Z"}}}, "cveMetadata": {"cveId": "CVE-2020-36948", "state": "PUBLISHED", "dateUpdated": "2026-03-05T01:27:04.698Z", "dateReserved": "2026-01-25T13:50:01.143Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-01-27T15:23:50.046Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "VestaCP", "vendor": "VestaCP", "versions": [{"status": "affected", "version": "0.9.8-26"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "VestaCP 0.9.8-26 contains a session token vulnerability in the LoginAs module that allows remote attackers to manipulate authentication tokens. Attackers can exploit insufficient token validation to access user accounts and perform unauthorized login requests without proper administrative permissions."}, {"lang": "es", "value": "VestaCP 0.9.8-26 contiene una vulnerabilidad de token de sesi\u00f3n en el m\u00f3dulo LoginAs que permite a atacantes remotos manipular tokens de autenticaci\u00f3n. Los atacantes pueden explotar la validaci\u00f3n insuficiente de tokens para acceder a cuentas de usuario y realizar solicitudes de inicio de sesi\u00f3n no autorizadas sin los permisos administrativos adecuados."}], "id": "CVE-2020-36948", "lastModified": "2026-06-17T03:16:35.073", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2020-36948", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-27T21:07:57.516937Z", "version": "2.0.3"}}]}, "published": "2026-01-27T16:16:12.213", "references": [{"source": "disclosure@vulncheck.com", "url": "https://vestacp.com/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.exploit-db.com/exploits/49219"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/vestacp-loginas-insufficient-session-validation"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulnerability-lab.com/get_content.php?id=2240"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M."}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://www.exploit-db.com/exploits/49219"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://www.vulnerability-lab.com/get_content.php?id=2240"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://www.vulnerability-lab.com/show.php?user=Benjamin%20K.M."}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"created": "2026-01-27T20:16:22.921933+00:00", "updated": "2026-01-27T20:16:22.921971+00:00", "vendors": ["vestacp", "vestacp$PRODUCT$control_panel", "vestacp$PRODUCT$vesta_control_panel"]}