PT-2021-17126 · Litespeed Technologies · Openlitespeed

Passtheticket · Published 2021-04-07 · Updated 2021-04-12 · CVE-2021-26758

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenLiteSpeed version 1.7.8

Description The issue allows attackers to gain root terminal access and execute commands on the host system. This is a result of a privilege escalation flaw in the OpenLiteSpeed web server.

Recommendations For OpenLiteSpeed version 1.7.8, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2021-26758

Affected Products

Openlitespeed

References · 6

• 🔥 https://github.com/litespeedtech/openlitespeed/issues/217 · Exploit
• 🔥 https://exploit-db.com/exploits/49556 · Exploit
• 🔥 https://docs.unsafe-inline.com/0day/openlitespeed-web-server-1.7.8-command-injection-to-privilege-escalation-cve-2021-26758 · Exploit
• https://osv.dev/vulnerability/CVE-2021-26758 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26758 · Security Note
• https://t.me/cvenotify/13115 · Telegram Post