HIGH🇵🇱 Wersja polska

CVE-2021-46850

CVSS 7.2v3.1pub. 2022-10-24upd. 2025-05-07

myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote administrative user can execute arbitrary commands via the v_sftp_license parameter when sending HTTP POST requests to the /edit/server endpoint.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Vestacp Control Panel

    APP
    Vestacp
    < 0.9.8-26-43

  • Vestacp Vesta Control Panel

    APP
    Vestacp
    < 0.9.8-26
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2021-43693CRITICAL9.8ten sam produkt

vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php.

CVE-2018-1000884CRITICAL9.8ten sam produkt

Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- any release prior to 0.9.8-18 con...

CVE-2021-30463HIGH7.8ten sam produkt

VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack...

CVE-2021-30462HIGH7.2ten sam produkt

VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration d...

CVE-2021-28379HIGH8.8ten sam produkt

web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-2...