CVE-2021-37840
Published: 02 August 2021
Summary
CVE-2021-37840 is a high-severity an unspecified weakness vulnerability in Aapanel Aapanel. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 39.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-24319
Vulnerability details
aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages at a ws:// URL for /webssh (the victim must have configured Terminal with at least one host). Successful exploitation depends on the browser used by a…
more
potential victim (e.g., exploitation can occur with Firefox but not Chrome).
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.