PT-2019-4644 · Centos · Centos Web Panel

Narin Boonwasanarak + 2 · Publicado 2019-09-10 · Atualizado 2023-01-24 · CVE-2019-14730

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions CentOS Web Panel version 0.9.8.851

Description The issue exists due to insufficient input validation in the application, allowing a remote attacker to delete a domain from a user's account. This can be achieved by an attacker using their own account to exploit the insecure object reference.

Recommendations For version 0.9.8.851, consider restricting access to domain management features until a patch is available. As a temporary workaround, monitor user accounts for unauthorized domain removals and restrict access to the vulnerable delete domain function to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2020-00810

CVE-2019-14730

Produtos afetados

Centos Web Panel

Referências · 7

• 🔥 https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-14730.md · Exploit
• https://osv.dev/vulnerability/CVE-2019-14730 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-14730 · Nota de Segurança
• https://centos-webpanel.com/changelog-cwp7 · Nota
• https://cxsecurity.com/cveshow/CVE-2019-14730 · Nota
• https://bdu.fstec.ru/vul/2020-00810 · Nota de Segurança
• https://packetstormsecurity.com/files/154404/Control-Web-Panel-0.9.8.851-Privilege-Escalation.html · Nota