CVE-2023-3479

Deeper analysis

CVE-2023-3479 is a reflected cross-site scripting vulnerability (CWE-79) affecting the Hestia Control Panel (hestiacp/hestiacp) in versions prior to 1.7.8. The flaw carries a CVSS 3.1 score of 6.1 with a network attack vector, low attack complexity, no required privileges, and required user interaction, resulting in limited impacts to confidentiality and integrity under a changed scope.

An unauthenticated remote attacker can exploit the issue by crafting a malicious URL that, when visited by an authenticated user, causes the victim's browser to execute attacker-controlled scripts within the context of the Hestia application. Successful exploitation allows limited data exposure or unauthorized actions on behalf of the targeted user but does not directly affect availability.

Public references point to commits that remediate the reflected XSS vectors; administrators should upgrade to version 1.7.8 or later to apply the fixes. The associated EPSS score reached a peak of 0.2638 before receding to its current value of 0.2352, indicating moderate but not sustained exploitation interest after disclosure.