PT-2019-4389 · Centos · Centos Web Panel

Narin Boonwasanarak + 2 · Published 2019-09-10 · Updated 2023-01-24 · CVE-2019-14728

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions CentOS Web Panel version 0.9.8.851

Description The issue is related to an insecure object reference in CentOS Web Panel, which allows an attacker to add an e-mail forwarding destination to a victim's account. This is due to insufficient input validation, enabling a remote attacker to exploit the weakness and modify a user's account settings by adding an email forwarding address.

Recommendations For version 0.9.8.851, as a temporary workaround, consider restricting access to email forwarding settings until a patch is available. Avoid using the email forwarding feature in the affected version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-00111

CVE-2019-14728

Affected Products

Centos Web Panel

References · 7

• 🔥 https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-14728.md · Exploit
• https://osv.dev/vulnerability/CVE-2019-14728 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14728 · Security Note
• https://bdu.fstec.ru/vul/2020-00111 · Security Note
• https://cxsecurity.com/cveshow/CVE-2019-14728 · Note
• https://centos-webpanel.com/changelog-cwp7 · Note
• https://packetstormsecurity.com/files/154404/Control-Web-Panel-0.9.8.851-Privilege-Escalation.html · Note