cPanel Multiple Security Vulnerabilities
BID:64472
Info
cPanel Multiple Security Vulnerabilities
| Bugtraq ID: | 64472 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Dec 23 2013 12:00AM |
| Updated: | Dec 23 2013 12:00AM |
| Credit: | Rack911 and the vendor |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
cPanel Multiple Security Vulnerabilities
cPanel is prone to the following security vulnerabilities:
1. Multiple security-bypass vulnerabilities
2. A insecure file-permission vulnerability
3. A privilege-escalation vulnerability
4. An information-disclosure vulnerability
5. A cross-site scripting vulnerability
6. A local privilege-escalation vulnerability
7. An arbitrary-file overwrite vulnerability
Attackers can exploit these issues to bypass certain security restrictions, gain elevated privileges, obtain sensitive information, write arbitrary files, perform certain unauthorized actions, execute HTML and script code and steal cookie-based authentication credentials or execute arbitrary code. Other attacks are possible.
cPanel is prone to the following security vulnerabilities:
1. Multiple security-bypass vulnerabilities
2. A insecure file-permission vulnerability
3. A privilege-escalation vulnerability
4. An information-disclosure vulnerability
5. A cross-site scripting vulnerability
6. A local privilege-escalation vulnerability
7. An arbitrary-file overwrite vulnerability
Attackers can exploit these issues to bypass certain security restrictions, gain elevated privileges, obtain sensitive information, write arbitrary files, perform certain unauthorized actions, execute HTML and script code and steal cookie-based authentication credentials or execute arbitrary code. Other attacks are possible.
Exploit / POC
cPanel Multiple Security Vulnerabilities
Attackers can exploit some of these issues through browser or using readily available tools.
Attackers can exploit some of these issues through browser or using readily available tools.
Solution / Fix
cPanel Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.