CVE-2022-3967 Vesta Control Panel sed main.sh argument injection

Medium 5.3 Published 13 Nov 2022 Updated 15 Apr 2025

A local attacker can exploit argument injection in the sed handler of Vesta Control Panel to execute arbitrary commands.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-3967?

CVE-2022-3967 is a medium-severity command injection vulnerability in unspecified Vesta Control Panel, published on 13 Nov 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability, which was classified as critical, was found in Vesta Control Panel. Affected is an unknown function of the file func/main.sh of the component sed Handler. The manipulation leads to argument injection. An attack has to be approached locally. The name of the patch is 39561c32c12cabe563de48cc96eccb9e2c655e25. It is recommended to apply a patch to fix this issue. VDB-213546 is the identifier assigned to this vulnerability.

Weakness: CWE-707

Which versions are affected by CVE-2022-3967?

It affects 1 product.

Products include Vestacp Control Panel.

How do I fix CVE-2022-3967?

No fix has been published for CVE-2022-3967 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2022-3967 being exploited?

There is no known exploitation of CVE-2022-3967 in the wild and no public exploit code.

Sources

Also known as GHSA-4r6q-vm97-xq39.