PT-2022-9948 · Hestiacp · Hestiacp

Published 2022-08-18 · Updated 2022-08-19 · CVE-2021-30070

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions HestiaCP versions prior to 1.3.5

Description An issue was discovered in HestiaCP where attackers can arbitrarily install packages due to values taken from the pgk parameter in the update request being transmitted to the operating system's package manager.

Recommendations For versions prior to 1.3.5, update to version 1.3.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the package manager or disabling the update request functionality until a patch is applied. Avoid using the pgk parameter in the update request until the issue is resolved.

Fix

Related Identifiers

CVE-2021-30070

Affected Products

Hestiacp

References · 8

• https://github.com/hestiacp/hestiacp/commit/9a1fccd37f2842fdf96ffb48895c4bfa9788c469 · Patch
• https://github.com/hestiacp/hestiacp/commit/27556a9a43aeaf308b33be224c2e70f2011574e6 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-30070 · Security Note
• https://osv.dev/vulnerability/CVE-2021-30070 · Vendor Advisory
• https://t.me/cvenotify/34972 · Telegram Post
• https://t.me/cvenotify/34842 · Telegram Post
• https://t.me/cvenotify/34860 · Telegram Post
• https://t.me/cibsecurity/48334 · Telegram Post