Vulnerability Details CVE-2021-46850
myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote administrative user can execute arbitrary commands via the v_sftp_license parameter when sending HTTP POST requests to the /edit/server endpoint.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.171
EPSS Ranking 94.6%
CVSS Severity
CVSS v3 Score 7.2
Products affected by CVE-2021-46850
-
cpe:2.3:a:vestacp:control_panel:0.9.7-13
-
cpe:2.3:a:vestacp:control_panel:0.9.7-14
-
cpe:2.3:a:vestacp:control_panel:0.9.7-15
-
cpe:2.3:a:vestacp:control_panel:0.9.7-16
-
cpe:2.3:a:vestacp:control_panel:0.9.7-17
-
cpe:2.3:a:vestacp:control_panel:0.9.7-18
-
cpe:2.3:a:vestacp:control_panel:0.9.7-19
-
cpe:2.3:a:vestacp:control_panel:0.9.7-20
-
cpe:2.3:a:vestacp:control_panel:0.9.7-21
-
cpe:2.3:a:vestacp:control_panel:0.9.7-22
-
cpe:2.3:a:vestacp:control_panel:0.9.8-1
-
cpe:2.3:a:vestacp:control_panel:0.9.8-10
-
cpe:2.3:a:vestacp:control_panel:0.9.8-11
-
cpe:2.3:a:vestacp:control_panel:0.9.8-12
-
cpe:2.3:a:vestacp:control_panel:0.9.8-13
-
cpe:2.3:a:vestacp:control_panel:0.9.8-14
-
cpe:2.3:a:vestacp:control_panel:0.9.8-15
-
cpe:2.3:a:vestacp:control_panel:0.9.8-16
-
cpe:2.3:a:vestacp:control_panel:0.9.8-17
-
cpe:2.3:a:vestacp:control_panel:0.9.8-18
-
cpe:2.3:a:vestacp:control_panel:0.9.8-19
-
cpe:2.3:a:vestacp:control_panel:0.9.8-2
-
cpe:2.3:a:vestacp:control_panel:0.9.8-20
-
cpe:2.3:a:vestacp:control_panel:0.9.8-21
-
cpe:2.3:a:vestacp:control_panel:0.9.8-22
-
cpe:2.3:a:vestacp:control_panel:0.9.8-23
-
cpe:2.3:a:vestacp:control_panel:0.9.8-24
-
cpe:2.3:a:vestacp:control_panel:0.9.8-25
-
cpe:2.3:a:vestacp:control_panel:0.9.8-3
-
cpe:2.3:a:vestacp:control_panel:0.9.8-4
-
cpe:2.3:a:vestacp:control_panel:0.9.8-5
-
cpe:2.3:a:vestacp:control_panel:0.9.8-6
-
cpe:2.3:a:vestacp:control_panel:0.9.8-7
-
cpe:2.3:a:vestacp:control_panel:0.9.8-8
-
cpe:2.3:a:vestacp:control_panel:0.9.8-9
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.7-0
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.7-13
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.7-14
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.7-15
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.7-16
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.7-17
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.7-18
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.7-19
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.7-20
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.7-21
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.7-22
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-1
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-10
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-11
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-12
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-13
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-14
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-15
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-16
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-17
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-18
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-19
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-2
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-20
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-21
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-22
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-23
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-24
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-3
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-4
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-5
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-6
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-7
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-8
-
cpe:2.3:a:vestacp:vesta_control_panel:0.9.8-9