CVE-2021-30070

An issue was discovered in HestiaCP before v1.3.5. Attackers are able to arbitrarily install packages due to values taken from the pgk parameter in the update request being transmitted to the operating system's package manager...

CVE-2021-30070

An issue was discovered in HestiaCP before v1.3.5. Attackers are able to arbitrarily install packages due to values taken from the pgk parameter in the update request being transmitted to the operating system's package manager...

CVE-2021-30070

CVE-2021-30070 affects HestiaCP prior to version 1.3.5. The vulnerability arises because values from the pgk [] parameter in an update request are transmitted to the operating system’s package manager, enabling an attacker to arbitrarily install packages. Root cause is improper handling/validatio...