A remote command execution in Vesta Control Panel through 0.9.8-26 allows any authenticated user to execute arbitrary commands on the system via cron jobs.
oryginał ENCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HVestacp Vesta Control Panel
APPVestacp≤ 0.9.8-26
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
CWE
Powiązane podatności
CVE-2021-43693CRITICAL9.8ten sam produkt
vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php.
CVE-2018-1000884CRITICAL9.8ten sam produkt
Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- any release prior to 0.9.8-18 con...
CVE-2021-46850HIGH7.2ten sam produkt
myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command inj...
CVE-2021-30462HIGH7.2ten sam produkt
VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration d...
CVE-2021-28379HIGH8.8ten sam produkt
web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-2...