CentOS Web Panel CVE-2019-10893 HTML Injection Vulnerability
BID:108035
CVE-2019-10893 |Info
CentOS Web Panel CVE-2019-10893 HTML Injection Vulnerability
| Bugtraq ID: | 108035 |
| Class: | Input Validation Error |
| CVE: |
CVE-2019-10893 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 18 2019 12:00AM |
| Updated: | Apr 18 2019 12:00AM |
| Credit: | DKM |
| Vulnerable: |
Control Web Panel CentOS Web Panel 0.9.8.793 Control Web Panel CentOS Web Panel 0.9.8.753 |
| Not Vulnerable: | |
Discussion
CentOS Web Panel CVE-2019-10893 HTML Injection Vulnerability
CentOS Web Panel is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
CentOS Web Panel (CWP) 0.9.8.793, and 0.9.8.753 are vulnerable; other versions may also be affected.
CentOS Web Panel is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
CentOS Web Panel (CWP) 0.9.8.793, and 0.9.8.753 are vulnerable; other versions may also be affected.
Exploit / POC
CentOS Web Panel CVE-2019-10893 HTML Injection Vulnerability
Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
Solution / Fix
CentOS Web Panel CVE-2019-10893 HTML Injection Vulnerability
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].