Cross-Site Scripting Vulnerability in Vesta Control Panel
CVE-2018-18547

6.1MEDIUM

Key Information:

Vendor

Vestacp

Status
Control Panel
Vendor
CVE Published:
24 October 2018

What is CVE-2018-18547?

Vesta Control Panel versions up to 0.9.8-22 are susceptible to Cross-Site Scripting vulnerabilities through multiple parameters including 'edit/web/', 'list/backup/', 'list/rrd/', and 'list/directory/'. Attackers can exploit these weaknesses to execute arbitrary JavaScript in the context of the user's browser, potentially leading to information theft or unauthorized actions on behalf of the user. It is crucial for administrators to update their Vesta Control Panel installations and apply security practices to mitigate such risks.

References

https://numanozdemir.com/vesta-vulns.txt
x_refsource_MISC
http://packetstormsecurity.com/files/149897/VestaCP-0.9.8...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.