TI-2015-02526 Aliases CVE-2015-2861 GHSA-3w2f-3jp8-6mj6

Cross-site request forgery (CSRF) vulnerability in Vesta Control Panel before 0.9.8-14…

LOW 32CWE-352Published 2015-06-18 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: Tampering
Confidentiality · integrity · availability: Partial · Partial · Partial
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

Cross-site request forgery (CSRF) vulnerability in Vesta Control Panel before 0.9.8-14 allows remote attackers to hijack the authentication of arbitrary users.

Why it matters now

EPSS 0.01203 68th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:vestacp:vesta_control_panel::::::::	up to 0.9.8-12	Vulnerable	VestaCP

cpe:2.3:a:vestacp:vesta_control_panel:*:*:*:*:*:*:*:* Versions up to 0.9.8-12 Vulnerable ·VestaCP

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2015-2861
2026-10-03 Alias added: GHSA-3w2f-3jp8-6mj6

References

Advisory 2

Other 1

https://github.com/serghey-rodin/vesta/commit/527e4a9a62204be9b34c1338fadfe959b0fd3974

TI-2020-08697 Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the… CVSS 3.1HIGH 8.8
TI-2021-09533 web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and… CVSS 3.1HIGH 8.8
TI-2020-08679 A remote command execution in Vesta Control Panel through 0.9.8-26 allows any… CVSS 3.1HIGH 8.8
TI-2021-19526 vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php. CVSS 3.1CRITICAL 9.8
TI-2018-16103 Vesta CP version Prior to commit f6f6f9cfbbf2979e301956d1c6ab5c44386822c0 -- any release… CVSS 3.0CRITICAL 9.8
TI-2019-07240 Vesta Control Panel (VestaCP) 0.9.7 through 0.9.8-23 is vulnerable to an authenticated… CVSS 3.1HIGH 8.8

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences