cPanel up to 64.0.20 Serverinfo_manpage API API Call directory traversal

A vulnerability classified as problematic was found in cPanel up to 64.0.20 (Hosting Control Software). This vulnerability affects some unknown processing of the component Serverinfo_manpage API. The manipulation as part of a API Call leads to a directory traversal vulnerability. The CWE definition for the vulnerability is CWE-22. As an impact it is known to affect confidentiality.

The weakness was presented 08/02/2019. The advisory is shared for download at documentation.cpanel.net. This vulnerability was named CVE-2017-18448 since 07/31/2019. There are neither technical details nor an exploit publicly available.

Upgrading to version 64.0.21 eliminates this vulnerability.

See 139332, 139333, 139334 and 139335 for similar entries.

Type

• Hosting Control Software

Name

• cPanel

• 🔒
• 🔒
• 🔒

• 🔒
• 🔒
• 🔒

VulDB Meta Base Score: 3.5
VulDB Meta Temp Score: 3.4

VulDB Base Score: ≈3.5
VulDB Temp Score: ≈3.4
VulDB Vector: 🔒
VulDB Reliability: 🔍

VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Class: Directory traversal (CWE-22)
Local: Yes
Remote: No

Availability: 🔒
Status: Not defined

Price Prediction: 🔍
Current Price Estimation: 🔒

Threat Intelligenceinfoedit

Threat: 🔍
Adversaries: 🔍
Geopolitics: 🔍
Economy: 🔍
Predictions: 🔍
Remediation: 🔍Recommended: Upgrade
Status: 🔍

0-Day Time: 🔒

Upgrade: cPanel 64.0.21

07/31/2019 CVE assigned
08/02/2019 +2 days Advisory disclosed
08/03/2019 +1 days VulDB entry created
08/03/2019 +0 days VulDB last updateAdvisory: documentation.cpanel.net

CVE: CVE-2017-18448 (🔒)
See also: 🔒

Created: 08/03/2019 07:52 AM
Complete: 🔍

Comments

Comments are closed.