PatchTheCVEvesta control panel vulnerabilities and fixes
Recent CVEs affecting vesta control panel, with upgrade or downgrade steps. 8 tracked.
Also searched as: vestacontrolpanel.
vesta control panel has 8 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 3. Most recent: 2022-10-24. Highest priority: CVE-2021-43693 (score 62/100).
- CVE-2022-36305 MEDIUM 6.1 DOWNGRADE Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the body function at /
- CVE-2022-36304 MEDIUM 6.1 DOWNGRADE Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the generate_response
- CVE-2022-36303 MEDIUM 6.1 DOWNGRADE Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the handle_file_upload
- CVE-2022-34025 MEDIUM 6.1 DOWNGRADE Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the post function at /
- CVE-2021-46850 HIGH 7.2 UPGRADE UPGRADE myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command inj
- CVE-2021-43693 CRITICAL 9.8 DOWNGRADE vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php.
- CVE-2021-30462 HIGH 7.2 UPGRADE VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration d
- CVE-2021-28379 HIGH 8.8 UPGRADE UPGRADE web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-2
FAQ
How do I fix vesta control panel vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is vesta control panel being exploited right now?
None of the tracked vesta control panel CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which vesta control panel CVE should I patch first?
CVE-2021-43693 currently ranks highest (62/100): vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php..