Command Injection Vulnerability in myVesta and Vesta Control Panel
CVE-2021-46850
7.2HIGH
What is CVE-2021-46850?
The myVesta Control Panel and Vesta Control Panel are susceptible to a command injection vulnerability that allows authenticated remote administrative users to execute arbitrary commands. This can occur through the 'v_sftp_license' parameter when sending HTTP POST requests to the '/edit/server' endpoint. Attackers exploiting this flaw could potentially manipulate server operations, posing serious security risks to the affected systems.
References
EPSS Score
15% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved