PT-2019-13304 · Centos · Centos Web Panel

Narin Boonwasanarak + 2 · Published 2019-07-26 · Updated 2023-01-24 · CVE-2019-13385

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions CentOS Web Panel version 0.9.8.840

Description The issue allows attackers to enumerate users and check for active users of the application by reading /tmp/login.log, potentially exposing file and directory information.

Recommendations For version 0.9.8.840, consider restricting access to the /tmp/login.log file to minimize the risk of exploitation. As a temporary workaround, restrict access to the filemanager module to prevent attackers from enumerating users and checking for active users.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2019-13385

Affected Products

Centos Web Panel

References · 5

• 🔥 https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13385.md · Exploit
• 🔥 http://packetstormsecurity.com/files/153877/CentOS-Control-Web-Panel-0.9.8.840-User-Enumeration.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13385 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13385 · Vendor Advisory
• https://centos-webpanel.com/changelog-cwp7 · Vendor Advisory