PT-2006-6550 · Cpanel · Cpanel

Published 2006-11-14 · Updated 2018-10-17 · CVE-2006-5883

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions cPanel version 10

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML. The affected parameters include the dir parameter in the "seldir.html" endpoint, and the user and dir parameters in the "newuser.html" endpoint.

Recommendations For cPanel version 10, update to a version that includes a fix for these XSS vulnerabilities to prevent remote authenticated users from injecting arbitrary web script or HTML. As a temporary workaround, consider restricting access to the "seldir.html" and "newuser.html" endpoints until a patch is available. Avoid using the dir, user parameters in these endpoints until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2006-5883

Affected Products

Cpanel

References · 12

• 🔥 http://aria-security.net/advisory/cpanel.txt · Exploit
• 🔥 https://exploit-db.com/exploits/28983 · Exploit
• 🔥 http://securityfocus.com/bid/21027 · Exploit
• 🔥 https://exploit-db.com/exploits/28982 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-5883 · Security Note
• http://securityfocus.com/archive/1/451374/100/0/threaded · Note
• http://securityreason.com/securityalert/1847 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5883 · Note
• http://secunia.com/advisories/22825 · Note
• http://osvdb.org/30386 · Note
• http://vupen.com/english/advisories/2006/4500 · Note
• http://osvdb.org/30387 · Note