cPanel Multiple Security Vulnerabilities

Bugtraq ID:	66561
Class:	Unknown
CVE:
Remote:	Yes
Local:	Yes
Published:	Apr 01 2014 12:00AM
Updated:	Apr 01 2014 12:00AM
Credit:	Rack911, Vendor and Prajith of NdimensionZ Solutions
Vulnerable:
Not Vulnerable:

cPanel Multiple Security Vulnerabilities

cPanel is prone to the following security vulnerabilities:

1. Multiple insecure file-permission vulnerabilities
2. A URI-redirection vulnerability
3. An arbitrary code-execution vulnerability
4. An arbitrary-file overwrite vulnerability
5. An information-disclosure vulnerability
6. A code-injection vulnerability
7. Multiple security-bypass vulnerabilities
8. Multiple HTML-injection vulnerabilities
9. A cross-site scripting vulnerability

Attackers can exploit these issues to bypass certain security restrictions, gain authenticated access, obtain sensitive information, write arbitrary files, perform certain unauthorized actions, perform phishing attacks, execute HTML and script code and steal cookie-based authentication credentials or execute arbitrary code. Other attacks are possible.

cPanel Multiple Security Vulnerabilities

Attackers can exploit some of these issues through browser or using readily available tools.

cPanel Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

cPanel Multiple Security Vulnerabilities

References:

• cPanel Homepage (cPanel)