PT-2019-3100 · Centos · Centos Web Panel

Published 2019-08-21 · Updated 2023-03-03 · CVE-2019-14245

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions CentOS Web Panel version 0.9.8.851

Description The issue is related to an insecure object reference, which allows an attacker to delete databases, such as oauthv2, from the server via an attacker account. This is due to insufficient access control, enabling a remote attacker to delete arbitrary databases from the server.

Recommendations For version 0.9.8.851, consider restricting access to database management functions to prevent unauthorized deletion of databases until a patch is available. As a temporary workaround, limit the privileges of attacker accounts to minimize the risk of exploitation.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

CWE-264

Related Identifiers

BDU:2019-03083

CVE-2019-14245

Affected Products

Centos Web Panel

References · 11

• 🔥 http://packetstormsecurity.com/files/154155/CentOS-Control-Web-Panel-CWP-0.9.8.851-Arbitrary-Database-Drop.html · Exploit
• 🔥 http://packetstormsecurity.com/files/154155/CentOS-WebPanel.com-Control-Web-Panel-CWP-0.9.8.851-Arbitrary-Database-Drop.html · Exploit
• 🔥 http://packetstormsecurity.com/files/154155/CentOS-WebPanel.com-CentOS-Control-Web-Panel-CWP-0.9.8.851-Arbitrary-Database-Drop.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-14245 · Security Note
• https://bdu.fstec.ru/vul/2019-03083 · Security Note
• https://osv.dev/vulnerability/CVE-2019-14245 · Vendor Advisory
• https://centos-webpanel.com/changelog-cwp7 · Note
• https://packetstormsecurity.com/files/154155/CentOS-Control-Web-Panel-CWP-0.9.8.851-Arbitrary-Database-Drop.html · Note
• https://cvedetails.com/cve/CVE-2019-14245 · Note
• https://cxsecurity.com/issue/WLB-2019080093 · Note
• https://t.me/cvenotify/45436 · Telegram Post