PT-2008-3587 · Cpanel · Cpanel

Matteo Carli · Published 2008-05-12 · Updated 2018-10-11 · CVE-2008-2070

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions cPanel versions 11.18.0 through 11.18.3 cPanel versions 11.22.0 through 11.22.2

Description The issue allows remote attackers to bypass XSS protection and inject arbitrary script or HTML via repeated, improperly-ordered "<" and ">" characters in the issue parameter to "scripts2/knowlegebase", user parameter to "scripts2/changeip", search parameter to "scripts2/listaccts", and other unspecified vectors.

Recommendations For cPanel versions 11.18.0 through 11.18.3, update to version 11.18.4 or later. For cPanel versions 11.22.0 through 11.22.2, update to version 11.22.3 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-2070

Affected Products

Cpanel

References · 13

• 🔥 https://exploit-db.com/exploits/31772 · Exploit
• 🔥 http://securityfocus.com/bid/29125 · Exploit
• 🔥 https://exploit-db.com/exploits/31773 · Exploit
• 🔥 https://exploit-db.com/exploits/31771 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-2070 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/42305 · Note
• http://secunia.com/advisories/30166 · Note
• http://securityfocus.com/archive/1/491864/100/0/threaded · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2070 · Note
• http://changelog.cpanel.net/?revision=0%3Btree=%3Btreeview=%3Bshow=html%3Bpp=25%3Bte=1314%3Bpg=2 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2008-May/062197.html · Note
• http://securityreason.com/securityalert/3866 · Note
• http://vupen.com/english/advisories/2008/1522/references · Note