Vulnerability · Published Apr 28, 2022 · Assigned by @huntrdev
CVE-2022-1509Command Injection Vulnerability in hestiacp/hestiacp
Critical 9.9
In plain English
A critical-severity command injection in hestiacp/hestiacp from hestiacp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.5% (higher than 92% of all known vulnerabilities).
Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)4.5%top 8.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitrary code under root context.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| hestiacp | hestiacp/hestiacp | unspecified – before 1.5.12 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
- https://huntr.dev/bounties/09e69dff-f281-4e51-8312-ed7ab7606338 x_refsource_CONFIRM
- https://github.com/hestiacp/hestiacp/commit/d50f95cf208049dfb6ac67a8020802121745bd60 x_refsource_MISC