{"id":"CVE-2019-12791","details":"A directory traversal vulnerability in the v-list-user script in Vesta Control Panel 0.9.8-24 allows remote attackers to escalate from regular registered users to root via the password reset form.","modified":"2026-10-24T10:47:41.535739517Z","published":"2019-08-15T21:15:11.510Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:vestacp:control_panel:0.9.8-24:*:*:*:*:*:*:*"],"extracted_events":[{"range":[{"introduced":"0.9.8-24"},{"last_affected":"0.9.8-24"}],"source":"CPE_STRING"}],"vendor_product":"vestacp:control_panel"}]},"references":[{"type":"ADVISORY","url":"https://github.com/serghey-rodin/vesta/issues/1921"},{"type":"EVIDENCE","url":"https://cardaci.xyz/advisories/2019/08/12/vesta-control-panel-0.9.8-24-privilege-escalation-in-the-password-reset-form/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/outroll/vesta","events":[{"introduced":"2da2c539f169c7c4a00b1e23fcf9c3c226faeb08"},{"last_affected":"2da2c539f169c7c4a00b1e23fcf9c3c226faeb08"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:vestacp:control_panel:0.9.8-24:*:*:*:*:*:*:*","range":[{"introduced":"0.9.8-24"},{"last_affected":"0.9.8-24"}],"source":"CPE_STRING"}]}}],"versions":["0.9.8-24"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12791.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}