PT-2008-3588 · Cpanel · Cpanel

CVE-2008-2071 · Publicado 2008-05-12 · Atualizado 2023-08-12

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions cPanel versions 11.18.0 through 11.18.3 cPanel versions 11.22.0 through 11.22.2

Description The issue allows remote attackers to perform unauthorized actions as cPanel administrators. This can be achieved via requests to "cpanel/whm/webmail" and other unspecified vectors. There have been reports of real-world incidents where attackers exploited this issue, with one incident involving a hosting company's site being compromised.

Recommendations For cPanel versions 11.18.0 through 11.18.3, update to version 11.18.4 or later. For cPanel versions 11.22.0 through 11.22.2, update to version 11.22.3 or later.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2008-2071

Produtos afetados

Cpanel

Referências · 11

• https://exchange.xforce.ibmcloud.com/vulnerabilities/42306 · Nota
• http://secunia.com/advisories/30166 · Nota
• https://twitter.com/DGec06/status/1690513534457671680 · Publicação no Twitter
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2071 · Nota
• http://securityfocus.com/archive/1/491864/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2071 · Nota de Segurança
• http://securityfocus.com/bid/29125 · Nota
• http://changelog.cpanel.net/?revision=0%3Btree=%3Btreeview=%3Bshow=html%3Bpp=25%3Bte=1314%3Bpg=2 · Nota
• http://lists.grok.org.uk/pipermail/full-disclosure/2008-May/062197.html · Nota
• http://securityreason.com/securityalert/3866 · Nota
• http://vupen.com/english/advisories/2008/1522/references · Nota