Arbitrary Package Installation Vulnerability in HestiaCP by HestiaCP
CVE-2021-30070

7.5HIGH

Key Information:

Vendor

Hestiacp

Status
Hestiacp
Vendor
CVE Published:
18 August 2022

What is CVE-2021-30070?

A vulnerability in HestiaCP allows attackers to exploit improper handling of update requests. Attackers can manipulate the 'pgk[]' parameter to instruct the operating system's package manager to install arbitrary packages, potentially leading to unauthorized access or system compromise. This issue affects versions of HestiaCP prior to 1.3.5, emphasizing the need for users to update to the latest version to mitigate risks associated with this vulnerability.

References

https://github.com/hestiacp/hestiacp/commit/9a1fccd37f284...
x_refsource_MISC
https://github.com/hestiacp/hestiacp/commit/27556a9a43aea...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.