Summaryinfo

A vulnerability was found in cPanel WHM up to 11.38.0.14 and classified as problematic. The affected element is an unknown function. Executing a manipulation can lead to improper authentication. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in cPanel WHM up to 11.38.0.14 (Hosting Control Software). This vulnerability affects an unknown code. The manipulation with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, and integrity.

The weakness was released 06/11/2013 as not defined bulletin (Website). The advisory is available at cpanel.net. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available.

Upgrading to version 11.38.0.15 eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at OSVDB (96857†). Entries connected to this vulnerability are available at VDB-10125, VDB-10127, VDB-10128 and VDB-10129. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Hosting Control Software

Name

• cPanel WHM

Version

• 11.38.0.0
• 11.38.0.1
• 11.38.0.2
• 11.38.0.3
• 11.38.0.4
• 11.38.0.5
• 11.38.0.6
• 11.38.0.7
• 11.38.0.8
• 11.38.0.9
• 11.38.0.10
• 11.38.0.11
• 11.38.0.12
• 11.38.0.13
• 11.38.0.14

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion