A vulnerability was found in cPanel up to 11.53.x (Hosting Control Software) and classified as critical. Affected by this issue is some unknown functionality of the component WHM API. The manipulation with an unknown input leads to a access control vulnerability (Zone). Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

cPanel before 11.54.0.0 allows unauthorized zone modification via the WHM API (SEC-66).

The weakness was published 08/01/2019. This vulnerability is handled as CVE-2016-10860 since 07/31/2019. The exploitation is known to be easy. The attack may be launched remotely. A simple authentication is required for exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

Upgrading to version 11.54.0.0 eliminates this vulnerability.

Similar entries are available at VDB-139194, VDB-139193, VDB-139189 and VDB-139188.

Productinfo

Type

• Hosting Control Software

Name

• cPanel

Version

• 11.0
• 11.1
• 11.2
• 11.3
• 11.4
• 11.5
• 11.6
• 11.7
• 11.8
• 11.9
• 11.10
• 11.11
• 11.12
• 11.13
• 11.14
• 11.15
• 11.16
• 11.17
• 11.18
• 11.19
• 11.20
• 11.21
• 11.22
• 11.23
• 11.24
• 11.25
• 11.26
• 11.27
• 11.28
• 11.29
• 11.30
• 11.31
• 11.32
• 11.33
• 11.34
• 11.35
• 11.36
• 11.37
• 11.38
• 11.39
• 11.40
• 11.41
• 11.42
• 11.43
• 11.44
• 11.45
• 11.46
• 11.47
• 11.48
• 11.49
• 11.50
• 11.51
• 11.52
• 11.53

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion