Vulnerability Description
ZesleCP 3.1.9 contains an authenticated remote code execution vulnerability that allows attackers to create malicious FTP accounts with shell injection payloads. Attackers can exploit the FTP account creation endpoint by injecting a reverse shell command that establishes a network connection to a specified listening host.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Zesle | Zeslecp | <= 3.1.9 |
Related Weaknesses (CWE)
References
- https://www.exploit-db.com/exploits/50233ExploitThird Party Advisory
- https://www.vulncheck.com/advisories/zeslecp-remote-code-execution-rce-authenticThird Party Advisory
- https://www.youtube.com/watch?v=5lTDTEBVq-0Exploit
- https://zeslecp.com/Product
FAQ
What is CVE-2021-47794?
CVE-2021-47794 is a vulnerability with a CVSS score of 8.8 (HIGH). ZesleCP 3.1.9 contains an authenticated remote code execution vulnerability that allows attackers to create malicious FTP accounts with shell injection payloads. Attackers can exploit the FTP account ...
How severe is CVE-2021-47794?
CVE-2021-47794 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-47794?
Check the references section above for vendor advisories and patch information. Affected products include: Zesle Zeslecp.