PT-2008-3935 · Cpanel · Cpanel

CVE-2008-2478 · Publicado 2008-05-28 · Atualizado 2024-08-07

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: cPanel versions 11.18.6 and earlier, 11.23.1 and earlier

Description: The issue allows remote authenticated users with reseller privileges to execute arbitrary code via shell metacharacters in the Email address field. The vendor disputes this issue, stating they are unable to reproduce it on multiple servers running different versions of cPanel.

Recommendations: For cPanel versions 11.18.6 and earlier, and 11.23.1 and earlier, consider restricting access to the scripts/wwwacct functionality to minimize the risk of exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-2478

Produtos afetados

Cpanel

Referências · 9

• 🔥 https://exploit-db.com/exploits/31807 · Exploit
• 🔥 http://securityfocus.com/bid/29277 · Exploit
• https://t.me/cvenotify/89596 · Publicação no Telegram
• http://securityfocus.com/archive/1/492259/100/0/threaded · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2478 · Nota
• http://securityfocus.com/archive/1/492223/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2478 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42529 · Nota
• http://securitytracker.com/id?1020042 · Nota