CVE-2020-10808

Katalog CVE

CVSS 8.8 · High EPSS 77,5%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada vestacp vesta control panel. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a crafted filename on the server, as demonstrated by an FTP session that renames .bash_logout to a .bash_logout' substring followed by shell metacharacters.

Rincian

Terbit di NVD

22 Maret 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

77,5% peluang dieksploitasi; lebih tinggi dari 99,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://forum.vestacp.com/viewforum.php?f=25 release notes · advisory vendor
• https://github.com/rapid7/metasploit-framework/pull/13094 patch · advisory pihak ketiga
• http://packetstormsecurity.com/files/157111/Vesta-Control-Panel-Authenticated-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• http://packetstormsecurity.com/files/157219/Vesta-Control-Panel-Authenticated-Remote-Code-Execution.html exploit · advisory pihak ketiga · vdb entry
• https://pentest.blog/vesta-control-panel-second-order-remote-code-execution-0day-step-by-step-analysis/ exploit · advisory pihak ketiga