search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Vesta Control Panel is vulnerable to cross-site request forgery

Vulnerability Note VU#842780

Original Release Date: 2015-06-16 | Last Revised: 2015-06-16


Vesta Control Panel is vulnerable to a cross-site request forgery (CSRF) attack.


CWE-352: Cross-Site Request Forgery (CSRF) - CVE-2015-2861

Vesta Control Panel contains a cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with the same permissions as a victim user, provided the victim has an active session and is induced to trigger the malicious request.


An unauthenticated remote attacker may perform actions with the same permissions of a victim user.


Apply an update

Vesta Control Panel has released version 0.9.8-14, which addresses this issue. Users are encouraged to update as soon as possible.

Vendor Information


Vesta Control Panel Affected

Notified:  June 02, 2015 Updated: June 09, 2015

Statement Date:   June 04, 2015



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.

CVSS Metrics

Group Score Vector
Base 6.0 AV:N/AC:M/Au:S/C:P/I:P/A:P
Temporal 4.7 E:POC/RL:OF/RC:C
Environmental 3.5 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND



Thanks to Ben Khlifa Fahmi and Ben Mné Tarek for reporting this vulnerability, and to Vesta Control Panel for quickly addressing the vulnerability.

This document was written by Garret Wassermann.

Other Information

CVE IDs: CVE-2015-2861
Date Public: 2015-06-05
Date First Published: 2015-06-16
Date Last Updated: 2015-06-16 22:26 UTC
Document Revision: 26

Sponsored by CISA.