PT-2019-13304 · Centos · Centos Web Panel

Narin Boonwasanarak + 2 · Publicado 2019-07-26 · Atualizado 2023-01-24 · CVE-2019-13385

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions CentOS Web Panel version 0.9.8.840

Description The issue allows attackers to enumerate users and check for active users of the application by reading /tmp/login.log, potentially exposing file and directory information.

Recommendations For version 0.9.8.840, consider restricting access to the /tmp/login.log file to minimize the risk of exploitation. As a temporary workaround, restrict access to the filemanager module to prevent attackers from enumerating users and checking for active users.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-13385

Produtos afetados

Centos Web Panel

Referências · 5

• 🔥 https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13385.md · Exploit
• 🔥 http://packetstormsecurity.com/files/153877/CentOS-Control-Web-Panel-0.9.8.840-User-Enumeration.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13385 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-13385 · Aviso do Fabricante
• https://centos-webpanel.com/changelog-cwp7 · Aviso do Fabricante