PT-2019-4389 · Centos · Centos Web Panel

Narin Boonwasanarak + 2 · Publicado 2019-09-10 · Atualizado 2023-01-24 · CVE-2019-14728

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions CentOS Web Panel version 0.9.8.851

Description The issue is related to an insecure object reference in CentOS Web Panel, which allows an attacker to add an e-mail forwarding destination to a victim's account. This is due to insufficient input validation, enabling a remote attacker to exploit the weakness and modify a user's account settings by adding an email forwarding address.

Recommendations For version 0.9.8.851, as a temporary workaround, consider restricting access to email forwarding settings until a patch is available. Avoid using the email forwarding feature in the affected version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2020-00111

CVE-2019-14728

Produtos afetados

Centos Web Panel

Referências · 7

• 🔥 https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-14728.md · Exploit
• https://cxsecurity.com/cveshow/CVE-2019-14728 · Nota
• https://osv.dev/vulnerability/CVE-2019-14728 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-14728 · Nota de Segurança
• https://centos-webpanel.com/changelog-cwp7 · Nota
• https://bdu.fstec.ru/vul/2020-00111 · Nota de Segurança
• https://packetstormsecurity.com/files/154404/Control-Web-Panel-0.9.8.851-Privilege-Escalation.html · Nota