PatchTheCVEvestacp vulnerabilities
Recent CVEs affecting vestacp products. 10 tracked.
vestacp has 10 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 5. Most recent: 2022-11-13. Highest priority: CVE-2021-43693 (score 62/100).
- CVE-2022-3967 MEDIUM 5.3 UPGRADE A vulnerability, which was classified as critical, was found in Vesta Control Panel
- CVE-2022-36305 MEDIUM 6.1 DOWNGRADE Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the body function at /
- CVE-2022-36304 MEDIUM 6.1 DOWNGRADE Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the generate_response
- CVE-2022-36303 MEDIUM 6.1 DOWNGRADE Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the handle_file_upload
- CVE-2022-34025 MEDIUM 6.1 DOWNGRADE Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the post function at /
- CVE-2021-46850 HIGH 7.2 UPGRADE UPGRADE myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command inj
- CVE-2021-43693 CRITICAL 9.8 DOWNGRADE vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php.
- CVE-2021-30463 HIGH 7.8 UPGRADE VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack
- CVE-2021-30462 HIGH 7.2 UPGRADE VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration d
- CVE-2021-28379 HIGH 8.8 UPGRADE UPGRADE web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-2
FAQ
How do I fix vestacp vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is vestacp being exploited right now?
None of the tracked vestacp CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which vestacp CVE should I patch first?
CVE-2021-43693 currently ranks highest (62/100): vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php..