cPanel up to 68.0.14 dovecot-xaps-plugin Format privilege escalation

A vulnerability was found in cPanel up to 68.0.14 (Hosting Control Software) and classified as critical. This issue affects an unknown part of the component dovecot-xaps-plugin. The manipulation with an unknown input leads to a privilege escalation vulnerability (Format). Using CWE to declare the problem leads to CWE-269. Impacted is confidentiality, integrity, and availability.

The weakness was shared 08/02/2019. The advisory is shared at documentation.cpanel.net. The identification of this vulnerability is CVE-2017-18389 since 07/31/2019. Neither technical details nor an exploit are publicly available.

Upgrading to version 68.0.15 eliminates this vulnerability.

The entries 139243, 139244, 139245 and 139246 are related to this item.

Type

• Hosting Control Software

Name

• cPanel

• 🔒
• 🔒
• 🔒

• 🔒
• 🔒
• 🔒

VulDB Meta Base Score: 5.5
VulDB Meta Temp Score: 5.3

VulDB Base Score: ≈5.5
VulDB Temp Score: ≈5.3
VulDB Vector: 🔒
VulDB Reliability: 🔍

VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Class: Privilege escalation / Format (CWE-269)
Local: Yes
Remote: No

Availability: 🔒
Status: Not defined

Price Prediction: 🔍
Current Price Estimation: 🔒

Threat Intelligenceinfoedit

Threat: 🔍
Adversaries: 🔍
Geopolitics: 🔍
Economy: 🔍
Predictions: 🔍
Remediation: 🔍Recommended: Upgrade
Status: 🔍

0-Day Time: 🔒

Upgrade: cPanel 68.0.15

07/31/2019 CVE assigned
08/02/2019 +2 days Advisory disclosed
08/02/2019 +0 days VulDB entry created
08/02/2019 +0 days VulDB last updateAdvisory: documentation.cpanel.net

CVE: CVE-2017-18389 (🔒)
See also: 🔒

Created: 08/02/2019 10:18 PM
Complete: 🔍

Comments

Comments are closed.