cPanel up to 82.0.17 JSON JSON String cross site scripting
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 5.1 | $0-$5k | 0.00 |
Summary
A vulnerability has been found in cPanel up to 82.0.17 and classified as problematic. This issue affects some unknown processing of the component JSON Handler. Performing a manipulation as part of JSON String results in cross site scripting. This vulnerability is cataloged as CVE-2019-20493. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.
Details
A vulnerability classified as problematic has been found in cPanel up to 82.0.17 (Hosting Control Software). This affects an unknown part of the component JSON Handler. The manipulation as part of a JSON String leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity. The summary by CVE is:
cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).
The weakness was shared 03/17/2020. This vulnerability is uniquely identified as CVE-2019-20493 since 03/05/2020. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.
Upgrading to version 82.0.18 eliminates this vulnerability.
The entries VDB-151753, VDB-151752, VDB-151751 and VDB-151750 are related to this item. If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Product
Type
Name
Version
- 82.0.0
- 82.0.1
- 82.0.2
- 82.0.3
- 82.0.4
- 82.0.5
- 82.0.6
- 82.0.7
- 82.0.8
- 82.0.9
- 82.0.10
- 82.0.11
- 82.0.12
- 82.0.13
- 82.0.14
- 82.0.15
- 82.0.16
- 82.0.17
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 5.2VulDB Meta Temp Score: 5.1
VulDB Base Score: 4.3
VulDB Temp Score: 4.1
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 6.1
NVD Vector: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Cross site scriptingCWE: CWE-79 / CWE-94 / CWE-74
CAPEC: 🔍
ATT&CK: 🔍
Physical: No
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: cPanel 82.0.18
Timeline
03/05/2020 🔍03/17/2020 🔍
03/18/2020 🔍
05/10/2025 🔍
Sources
Advisory: documentation.cpanel.netStatus: Confirmed
CVE: CVE-2019-20493 (🔍)
GCVE (CVE): GCVE-0-2019-20493
GCVE (VulDB): GCVE-100-151749
See also: 🔍
Entry
Created: 03/18/2020 07:58Updated: 05/10/2025 18:38
Changes: 03/18/2020 07:58 (38), 03/18/2020 08:03 (18), 04/17/2024 09:01 (18), 05/10/2025 18:38 (5)
Complete: 🔍
Cache ID: 216::103
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
No comments yet. Languages: en.
Please log in to comment.