Description
VestaCP versions prior to 0.9.8-25 contain a cross-site scripting vulnerability in the IP interface configuration that allows attackers to inject malicious scripts. Attackers can exploit the 'v_interface' parameter by sending a crafted POST request to the add/ip/ endpoint with a stored XSS payload.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| VestaCP | VestaCP | 0.9.8 – ≤ 0.9.8-25 | — |
References
- ExploitDB-49662 exploit
- VestaCP Official Vendor Homepage product
- VestaCP Alternative Download Site product
- VulnCheck Advisory: VestaCP < 0.9.8-25 - Stored Cross-Site Scripting third-party-advisory