CVE-2021-28379

EPSS 6.0%

No sign of exploitation. has a public proof of concept.

Vexday Risk Score

23Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS —EPSS 6.0%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

15 Mar 2021Published on NVD

17 Mar 2021Public PoC

Weaponization speed

2 daysto first PoC

Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.

Recommendation: Plan a near-term fix — a public PoC already exists.

web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/161836/VestaCP-0.9.8-Cross-Site-Request-Forgery.htmlunverified exploitdbwww.exploit-db.com/exploits/49659unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/161836/VestaCP-0.9.8-Cross-Site-Request-Forgery.html https://github.com/myvesta/vesta/commit/3402071e950e76b79fa8672a1e09b70d3860f355