CVE-2017-18416

Published: Aug 2, 2019Modified: Nov 21, 2024

5.5

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

cPanel before 67.9999.103 allows arbitrary file-overwrite operations during a Roundcube SQLite schema update (SEC-303).

Affected (6)

Products: Cpanel: Cpanel

1 product

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Cpanel Cpanel	version < 56.0.52
Cpanel Cpanel	57.9999.48 ≤ version < 60.0.48
Cpanel Cpanel	61.9999.55 ≤ version < 62.0.30
Cpanel Cpanel	62.0.31 ≤ version < 64.0.40
Cpanel Cpanel	64.0.42 ≤ version < 66.0.23
Cpanel Cpanel	66.0.24 ≤ version < 67.9999.103

Related CWEs

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (3)

https://documentation.cpanel.net/display/CL/68+Change+Log

Source: cve@mitre.org

Release NotesVendor Advisory

https://news.cpanel.com/cpanel-tsr-2017-0005-full-disclosure/

Source: nvd@nist.gov

Vendor Advisory

https://documentation.cpanel.net/display/CL/68+Change+Log

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.