Command Injection Vulnerability in Vesta Control Panel by Vesta
CVE-2019-12792

8.8HIGH

Key Information:

Vendor

Vestacp

Status
Control Panel
Vendor
CVE Published:
15 August 2019

What is CVE-2019-12792?

A security flaw in UploadHandler.php of the Vesta Control Panel version 0.9.8-24 enables remote attackers, by exploiting this command injection vulnerability, to escalate privileges from regular registered users to root access. This can lead to unauthorized control over the system, making it crucial for users of affected versions to apply necessary security patches and implement monitoring strategies to mitigate potential exploitation.

References

https://github.com/serghey-rodin/vesta/issues/1921
x_refsource_CONFIRM
https://cardaci.xyz/advisories/2019/08/12/vesta-control-p...
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.