PT-2008-3587 · Cpanel · Cpanel

Matteo Carli · Publicado 2008-05-12 · Atualizado 2018-10-11 · CVE-2008-2070

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions cPanel versions 11.18.0 through 11.18.3 cPanel versions 11.22.0 through 11.22.2

Description The issue allows remote attackers to bypass XSS protection and inject arbitrary script or HTML via repeated, improperly-ordered "<" and ">" characters in the issue parameter to "scripts2/knowlegebase", user parameter to "scripts2/changeip", search parameter to "scripts2/listaccts", and other unspecified vectors.

Recommendations For cPanel versions 11.18.0 through 11.18.3, update to version 11.18.4 or later. For cPanel versions 11.22.0 through 11.22.2, update to version 11.22.3 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-2070

Produtos afetados

Cpanel

Referências · 13

• 🔥 https://exploit-db.com/exploits/31772 · Exploit
• 🔥 http://securityfocus.com/bid/29125 · Exploit
• 🔥 https://exploit-db.com/exploits/31773 · Exploit
• 🔥 https://exploit-db.com/exploits/31771 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42305 · Nota
• http://secunia.com/advisories/30166 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2070 · Nota de Segurança
• http://securityfocus.com/archive/1/491864/100/0/threaded · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2070 · Nota
• http://changelog.cpanel.net/?revision=0%3Btree=%3Btreeview=%3Bshow=html%3Bpp=25%3Bte=1314%3Bpg=2 · Nota
• http://lists.grok.org.uk/pipermail/full-disclosure/2008-May/062197.html · Nota
• http://securityreason.com/securityalert/3866 · Nota
• http://vupen.com/english/advisories/2008/1522/references · Nota