Vulnerabilities > CVE-2021-37840 - Unspecified vulnerability in Aapanel

CVSS 6.8 - MEDIUM

Attack vector

NETWORK

Attack complexity

MEDIUM

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

network

aapanel

NVD

Published: 2021-08-02

Updated: 2021-08-10

Summary

aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages at a ws:// URL for /webssh (the victim must have configured Terminal with at least one host). Successful exploitation depends on the browser used by a potential victim (e.g., exploitation can occur with Firefox but not Chrome).

Vulnerable Configurations

Part	Description	Count
Application	Aapanel Aapanel Aapanel - Aapanel Aapanel 6.0.0 Aapanel Aapanel 6.0.1 Aapanel Aapanel 6.0.2 Aapanel Aapanel 6.0.3 Aapanel Aapanel 6.0.4 Aapanel Aapanel 6.0.5 Aapanel Aapanel 6.1.0 Aapanel Aapanel 6.1.1 Aapanel Aapanel 6.1.2 Aapanel Aapanel 6.1.3 Aapanel Aapanel 6.1.4 Aapanel Aapanel 6.1.5 Aapanel Aapanel 6.1.6 Aapanel Aapanel 6.2.0 Aapanel Aapanel 6.2.1 Aapanel Aapanel 6.2.2 Aapanel Aapanel 6.2.3 Aapanel Aapanel 6.2.4 Aapanel Aapanel 6.2.5 Aapanel Aapanel 6.2.6 Aapanel Aapanel 6.2.7 Aapanel Aapanel 6.2.8 Aapanel Aapanel 6.3.0 Aapanel Aapanel 6.3.1 Aapanel Aapanel 6.3.2 Aapanel Aapanel 6.3.3 Aapanel Aapanel 6.5.0 Aapanel Aapanel 6.5.1 Aapanel Aapanel 6.5.2 Aapanel Aapanel 6.5.3 Aapanel Aapanel 6.5.4 Aapanel Aapanel 6.5.5 Aapanel Aapanel 6.5.6 Aapanel Aapanel 6.5.7 Aapanel Aapanel 6.5.8 Aapanel Aapanel 6.5.9 Aapanel Aapanel 6.6.0 Aapanel Aapanel 6.6.1 Aapanel Aapanel 6.6.2 Aapanel Aapanel 6.6.3 Aapanel Aapanel 6.6.4 Aapanel Aapanel 6.6.5 Aapanel Aapanel 6.6.6 Aapanel Aapanel 6.6.7 Aapanel Aapanel 6.6.8 Aapanel Aapanel 6.6.9 Aapanel Aapanel 6.7.0 Aapanel Aapanel 6.7.1 Aapanel Aapanel 6.7.2 Aapanel Aapanel 6.7.3 Aapanel Aapanel 6.8.4 Aapanel Aapanel 6.8.8 Aapanel Aapanel 6.8.12	54

Summary

Vulnerable Configurations

References