PT-2006-6550 · Cpanel · Cpanel

Publicado 2006-11-14 · Atualizado 2018-10-17 · CVE-2006-5883

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions cPanel version 10

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML. The affected parameters include the dir parameter in the "seldir.html" endpoint, and the user and dir parameters in the "newuser.html" endpoint.

Recommendations For cPanel version 10, update to a version that includes a fix for these XSS vulnerabilities to prevent remote authenticated users from injecting arbitrary web script or HTML. As a temporary workaround, consider restricting access to the "seldir.html" and "newuser.html" endpoints until a patch is available. Avoid using the dir, user parameters in these endpoints until the issue is resolved.

Exploit

Correção

Identificadores relacionados

CVE-2006-5883

Produtos afetados

Cpanel

Referências · 12

• 🔥 http://aria-security.net/advisory/cpanel.txt · Exploit
• 🔥 https://exploit-db.com/exploits/28983 · Exploit
• 🔥 http://securityfocus.com/bid/21027 · Exploit
• 🔥 https://exploit-db.com/exploits/28982 · Exploit
• http://securityfocus.com/archive/1/451374/100/0/threaded · Nota
• http://securityreason.com/securityalert/1847 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5883 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-5883 · Nota de Segurança
• http://secunia.com/advisories/22825 · Nota
• http://osvdb.org/30386 · Nota
• http://vupen.com/english/advisories/2006/4500 · Nota
• http://osvdb.org/30387 · Nota