PT-2006-7151 · Cpanel · Cpanel Webhost Manager

Publicado 2006-12-14 · Atualizado 2018-10-17 · CVE-2006-6548

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions cPanel WebHost Manager (WHM) version 3.1.0

Description The issue allows remote authenticated users to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved by manipulating the domain parameter in specific API endpoints, such as "/scripts2/changeemail", "/scripts2/limitbw", or "/scripts/rearrangeacct".

Recommendations For cPanel WebHost Manager (WHM) version 3.1.0, consider restricting access to the vulnerable API endpoints "/scripts2/changeemail", "/scripts2/limitbw", and "/scripts/rearrangeacct" until a patch is available. Avoid using the domain parameter in these endpoints to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-6548

Produtos afetados

Cpanel Webhost Manager

Referências · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/30792 · Nota
• http://securityreason.com/securityalert/2027 · Nota
• http://aria-security.com/forum/showthread.php?t=44 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-6548 · Nota de Segurança
• http://securityfocus.com/archive/1/453885/100/0/threaded · Nota