cPanel WHM XML and JSON APIs Multiple Arbitrary File Disclosure Vulnerabilities

Bugtraq ID:	64511
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Dec 21 2013 12:00AM
Updated:	Dec 21 2013 12:00AM
Credit:	cPanel Security Team
Vulnerable:	cPanel cPanel 11.40.1 6 cPanel cPanel 11.40.1 3 cPanel cPanel 11.40.1 2 cPanel cPanel 11.40 30 cPanel cPanel 11.40 29 cPanel cPanel 11.40 28 cPanel cPanel 11.38.2 14 cPanel cPanel 11.38.2 13 cPanel cPanel 11.38.2 12 cPanel cPanel 11.36.2 11 cPanel cPanel 11.36.2 10 cPanel cPanel 11.40.0.12 cPanel cPanel 11.40.0.11 cPanel cPanel 11.40.0.10 cPanel cPanel 11.38.2.6 cPanel cPanel 11.38.2.5 cPanel cPanel 11.38.2.11 cPanel cPanel 11.38.2.10 cPanel cPanel 11.36.2.9 cPanel cPanel 11.36.2.8 cPanel cPanel 11.36.2.7 cPanel cPanel 11.36.2.3 cPanel cPanel 11.36.2.2
Not Vulnerable:	cPanel cPanel 11.40.1 7 cPanel cPanel 11.40 31 cPanel cPanel 11.38.2 15 cPanel cPanel 11.36.2 12

cPanel WHM XML and JSON APIs Multiple Arbitrary File Disclosure Vulnerabilities

cPanel is prone to multiple arbitrary file-disclosure vulnerabilities.

An attacker can exploit these issues to read arbitrary files within the context of the affected application. Other attacks are also possible.

Versions prior to cPanel 11.40.1.7, 11.40.0.31, 11.38.2.15, and 11.36.2.12 are vulnerable.

cPanel WHM XML and JSON APIs Multiple Arbitrary File Disclosure Vulnerabilities

Attackers can exploit these issues through a browser.

cPanel WHM XML and JSON APIs Multiple Arbitrary File Disclosure Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

cPanel WHM XML and JSON APIs Multiple Arbitrary File Disclosure Vulnerabilities

References:

• cPanel Homepage (cPanel)
  
• TSR 2013-0012 Full Disclosure (cPanel)
  
• TSR-2013-0012 Announcement (cPanel)