CVE-2021-46850

2022-10-2400:00:00

mitre

www.cve.org

cve-2021-46850

command injection

authentication bypass

http post

7.8 High

AI Score

Confidence

High

0.028 Low

EPSS

Percentile

90.7%

JSON

myVesta Control Panel before 0.9.8-26-43 and Vesta Control Panel before 0.9.8-26 are vulnerable to command injection. An authenticated and remote administrative user can execute arbitrary commands via the v_sftp_license parameter when sending HTTP POST requests to the /edit/server endpoint.