Vesta Control Panel CVE-2015-2861 Cross Site Request Forgery Vulnerability

Bugtraq ID:	75215
Class:	Input Validation Error
CVE:	CVE-2015-2861
Remote:	Yes
Local:	No
Published:	Jun 16 2015 12:00AM
Updated:	Jun 16 2015 12:00AM
Credit:	Ben Khlifa Fahmi
Vulnerable:	Vesta Control Panel 0.9.8-9 Vesta Control Panel 0.9.8-12 Vesta Control Panel 0.9.8-11 Vesta Control Panel 0.9.8-10
Not Vulnerable:	Vesta Control Panel 0.9.8-14

Vesta Control Panel CVE-2015-2861 Cross Site Request Forgery Vulnerability

Vesta Control Panel is prone to a cross-site request-forgery vulnerability.

An attacker can exploit this issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.

Vesta Control Panel 0.9.8-12 and prior versions are vulnerable.

Vesta Control Panel CVE-2015-2861 Cross Site Request Forgery Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.

Vesta Control Panel CVE-2015-2861 Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Vesta Control Panel CVE-2015-2861 Cross Site Request Forgery Vulnerability

References:

• Fixed security bug #CVE-2015-2861 (CSRF vulnerability) Thanks to Ben Khlifa Fahm (Vesta)
  
• Vesta Control Panel Homepage (Ben khlifa Fahmi)
  
• Vesta Control Panel is vulnerable to cross-site request forgery (Cert)