CVE-2021-28379
published 2021-03-15CVE-2021-28379: web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin.
PriorityP359high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
6.03%
92.5th percentile
web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| myvestacp | myvesta | <= 0.9.8-26-39 | — |
| vestacp | vesta_control_panel | <= 0.9.8-27 | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/161836/VestaCP-0.9.8-Cross-Site-Request-Forgery.htmlhttps://github.com/myvesta/vesta/commit/3402071e950e76b79fa8672a1e09b70d3860f355http://packetstormsecurity.com/files/161836/VestaCP-0.9.8-Cross-Site-Request-Forgery.htmlhttps://github.com/myvesta/vesta/commit/3402071e950e76b79fa8672a1e09b70d3860f355
2021-03-15
Published