PT-2019-4355 · Centos · Centos Web Panel

Pongtorn Angsuchotmetee · Published 2019-07-15 · Updated 2023-01-24 · CVE-2019-13360

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CentOS Web Panel version 0.9.8.836

Description The issue is related to weaknesses in the authentication procedure of the CentOS Web Panel application. It allows a remote attacker to bypass authentication in the login process by leveraging knowledge of a valid username. This can potentially enable the attacker to elevate their privileges.

Recommendations For version 0.9.8.836, consider restricting access to the login process until a patch is available. As a temporary workaround, monitor login attempts closely to detect potential unauthorized access.

Exploit

Fix

Improper Authentication

IDOR

Weakness Enumeration

CWE-287

CWE-639

Related Identifiers

BDU:2020-00076

CVE-2019-13360

Affected Products

Centos Web Panel

References · 9

• 🔥 https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13360.md · Exploit
• 🔥 https://exploit-db.com/exploits/47123 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-13360 · Security Note
• https://bdu.fstec.ru/vul/2020-00076 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13360 · Vendor Advisory
• https://packetstormsecurity.com/files/153665/CentOS-Control-Web-Panel-0.9.8.836-Authentication-Bypass.html · Note
• http://packetstormsecurity.com/files/153665/CentOS-Control-Web-Panel-0.9.8.836-Authentication-Bypass.html · Note
• https://t.me/cvenotify/42745 · Telegram Post
• https://exploit.kitploit.com/2019/07/centos-control-web-panel-098836_16.html · Note