PT-2021-17338 · Unknown · Hestia Control Panel

Kujoe + 1 · Published 2021-02-16 · Updated 2021-06-03 · CVE-2021-27231

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Hestia Control Panel versions 1.3.5 and below Hestia Control Panel versions 1.3.3 and below can be consolidated into the previous line, so the final output is: Hestia Control Panel versions 1.3.5 and below

Description: The issue allows remote authenticated users to create a subdomain for a different customer's domain name in a shared-hosting environment, leading to potential spoofing of services or email messages.

Recommendations: For Hestia Control Panel versions 1.3.5 and below, consider restricting subdomain creation privileges to prevent unauthorized access to other customers' domain names until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2021-27231

Affected Products

Hestia Control Panel

References · 7

• 🔥 https://sick.codes/sick-2021-006 · Exploit
• https://hestiacp.com · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27231 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27231 · Security Note
• https://github.com/hestiacp/hestiacp/issues/1622 · Note
• https://github.com/sickcodes/security/blob/master/advisories/sick-2021-006.md · Note
• https://t.me/cibsecurity/23624 · Telegram Post