PT-2006-6828 · Cpanel · Cpanel Webhost Manager
Published
2006-12-01
·
Updated
2018-10-17
·
CVE-2006-6198
CVSS v2.0
6.0
Medium
| Vector | AV:N/AC:M/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
cPanel WebHost Manager (WHM) version 3.1.0
Description
The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML. The affected API endpoints include:
"/scripts2/dochangeemail" with the
email parameter,
"/cgi/addon configsupport.cgi" with the supporturl parameter,
"/scripts/editpkg" with the pkg parameter,
"/scripts2/domts2" and "/scripts/editzone" with the domain parameter,
"/scripts2/dofeaturemanager" with the feature parameter, and
"/scripts/park" with the ndomain parameter.Recommendations
For cPanel WebHost Manager (WHM) version 3.1.0, consider disabling access to the affected API endpoints until a patch is available.
Restrict the use of the
email, supporturl, pkg, domain, feature, and ndomain parameters in the respective endpoints to minimize the risk of exploitation.
Avoid using these parameters in the affected API endpoints until the issue is resolved.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Cpanel Webhost Manager