high7.5
CVE-2021-30070
An issue was discovered in HestiaCP before v1.3.5.
Impact
An issue was discovered in HestiaCP before v1.3.5. Attackers are able to arbitrarily install packages due to values taken from the pgk [] parameter in the update request being transmitted to the operating system's package manager.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hestiacp | Hestiacp | before 1.3.5 |
References
- NVD record
- CVE.org record
- https://github.com/hestiacp/hestiacp/commit/27556a9a43aeaf308b33be224c2e70f2011574e6
- https://github.com/hestiacp/hestiacp/commit/9a1fccd37f2842fdf96ffb48895c4bfa9788c469
- https://github.com/hestiacp/hestiacp/commit/27556a9a43aeaf308b33be224c2e70f2011574e6
- https://github.com/hestiacp/hestiacp/commit/9a1fccd37f2842fdf96ffb48895c4bfa9788c469