{
  "schema_version": "1.4.0",
  "id": "GHSA-ffhx-6p84-463h",
  "modified": "2022-10-25T19:00:35Z",
  "published": "2022-10-24T19:00:23Z",
  "aliases": [
    "CVE-2021-46850"
  ],
  "details": "myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote administrative user can execute arbitrary commands via the v_sftp_license parameter when sending HTTP POST requests to the /edit/server endpoint.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46850"
    },
    {
      "type": "WEB",
      "url": "https://github.com/myvesta/vesta/commit/7991753ab7c5c568768028fb77554db8ea149f17"
    },
    {
      "type": "WEB",
      "url": "https://github.com/serghey-rodin/vesta/commit/a4e4542a6d1351c2857b169f8621dd9a13a2e896"
    },
    {
      "type": "WEB",
      "url": "https://blog.talosintelligence.com/2021/06/necro-python-bot-adds-new-tricks.html"
    },
    {
      "type": "WEB",
      "url": "https://github.com/myvesta/vesta/releases/tag/0.9.8-26-43"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/49674"
    }
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77",
      "CWE-88"
    ],
    "severity": "HIGH",
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-24T14:15:00Z"
  }
}