cPanel Multiple Security Vulnerabilities
BID:65464
Info
cPanel Multiple Security Vulnerabilities
| Bugtraq ID: | 65464 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Feb 05 2014 12:00AM |
| Updated: | Feb 05 2014 12:00AM |
| Credit: | Rack911 and the vendor |
| Vulnerable: |
cPanel cPanel 11.38.2 15 cPanel cPanel 11.38.2 14 cPanel cPanel 11.38.2 13 cPanel cPanel 11.38.2 12 cPanel cPanel 11.42.0.3 cPanel cPanel 11.40.1.9 cPanel cPanel 11.38.2.6 cPanel cPanel 11.38.2.5 cPanel cPanel 11.38.2.11 cPanel cPanel 11.38.2.10 |
| Not Vulnerable: |
cPanel cPanel 11.42.0.4 cPanel cPanel 11.40.1.10 cPanel cPanel 11.38.2.16 |
Discussion
cPanel Multiple Security Vulnerabilities
cPanel is prone to the following security vulnerabilities:
1. An insecure file-permission vulnerability
2. A directory-traversal vulnerability
3. A security-bypass vulnerability
4. An arbitrary-file overwrite vulnerability
5. Multiple security-bypass vulnerabilities
6. A authentication-bypass vulnerability
7. An arbitrary code-execution vulnerability
8. Multiple HTML-injection vulnerabilities
9. Multiple privilege-escalation vulnerabilities
10. An arbitrary PHP code-execution vulnerability
11. Multiple HTML-injection vulnerabilities
12. A cross-site scripting vulnerability
Attackers can exploit these issues to bypass certain security restrictions, gain elevated privileges, gain authenticated access, obtain sensitive information, write arbitrary files, perform certain unauthorized actions, execute HTML and script code and steal cookie-based authentication credentials or execute arbitrary code. Other attacks are possible.
cPanel versions prior to 11.38.2.16, 11.40.1.10, and 11.42.0.4 are vulnerable.
cPanel is prone to the following security vulnerabilities:
1. An insecure file-permission vulnerability
2. A directory-traversal vulnerability
3. A security-bypass vulnerability
4. An arbitrary-file overwrite vulnerability
5. Multiple security-bypass vulnerabilities
6. A authentication-bypass vulnerability
7. An arbitrary code-execution vulnerability
8. Multiple HTML-injection vulnerabilities
9. Multiple privilege-escalation vulnerabilities
10. An arbitrary PHP code-execution vulnerability
11. Multiple HTML-injection vulnerabilities
12. A cross-site scripting vulnerability
Attackers can exploit these issues to bypass certain security restrictions, gain elevated privileges, gain authenticated access, obtain sensitive information, write arbitrary files, perform certain unauthorized actions, execute HTML and script code and steal cookie-based authentication credentials or execute arbitrary code. Other attacks are possible.
cPanel versions prior to 11.38.2.16, 11.40.1.10, and 11.42.0.4 are vulnerable.
Solution / Fix
cPanel Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
cPanel Multiple Security Vulnerabilities
References:
References: