PT-2004-2511 · Cpanel · Cpanel

Published 2004-10-18 · Updated 2024-01-26 · CVE-2004-1603

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions cPanel version 9.4.1-RELEASE-64

Description The issue allows local users to read arbitrary files via the backup feature or chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled. This is due to the software following hard links.

Recommendations For cPanel version 9.4.1-RELEASE-64, consider restricting access to the backup feature and limiting modifications to the .htaccess file to minimize the risk of exploitation. As a temporary workaround, consider disabling Front Page extensions until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2004-1603

Affected Products

Cpanel

References · 10

• 🔥 http://securityfocus.com/bid/11449 · Exploit
• 🔥 http://securityfocus.com/bid/11455 · Exploit
• 🔥 http://secunia.com/advisories/12865 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2004-1603 · Security Note
• http://marc.info/?l=bugtraq&m=109811654104208&w=2 · Note
• http://marc.info/?l=bugtraq&m=109811572123753&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17780 · Note
• https://t.me/cvenotify/68866 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/17779 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1603 · Note