Multiple vulnerabilities in cPanel, cPanel

Published: 2019-08-01 | Updated: 2020-07-17

Risk	High
Patch available	YES
Number of vulnerabilities	5
CVE-ID	CVE-2016-10814 CVE-2016-10815 CVE-2016-10816 CVE-2016-10817 CVE-2016-10819
CWE-ID	CWE-20 CWE-200 CWE-89 CWE-532
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	cPanel Web applications / Remote management & hosting panels
Vendor	cPanel, Inc

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU30946

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-10814

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to execute arbitrary code.

cPanel before 57.9999.54 allows demo-mode escape via show_template.stor (SEC-119).

Mitigation

Install update from vendor's website.

Vulnerable software versions

cPanel: 11.56.0.1 - 11.56.0.14

CPE2.3

External links

http://documentation.cpanel.net/display/CL/58+Change+Log
http://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU30947

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-10815

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to gain access to sensitive information.

cPanel before 57.9999.54 allows arbitrary file-read operations for Webmail accounts via Branding APIs (SEC-120).

Mitigation

Install update from vendor's website.

Vulnerable software versions

cPanel: 11.56.0.1 - 11.56.0.14

CPE2.3

External links

http://documentation.cpanel.net/display/CL/58+Change+Log
http://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU30948

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-10816

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to execute arbitrary code.

cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121).

Mitigation

Install update from vendor's website.

Vulnerable software versions

cPanel: 11.56.0.1 - 11.56.0.14

CPE2.3

External links

http://documentation.cpanel.net/display/CL/58+Change+Log
http://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) SQL injection

EUVDB-ID: #VU30949

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-10817

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data passed via the ModSecurity TailWatch log file (SEC-123). A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Mitigation

Update to version 56.0.15.

Vulnerable software versions

cPanel: 11.56.0.1 - 11.56.0.14

CPE2.3

External links

http://documentation.cpanel.net/display/CL/58+Change+Log
http://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Inclusion of Sensitive Information in Log Files

EUVDB-ID: #VU30950

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-10819

CWE-ID: CWE-532 - Information Exposure Through Log Files

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to gain access to sensitive information.

In cPanel before 57.9999.54, user log files become world-readable when rotated by cpanellogd (SEC-125).

Mitigation

Install update from vendor's website.

Vulnerable software versions

cPanel: 11.56.0.1 - 11.56.0.14

CPE2.3

External links

http://documentation.cpanel.net/display/CL/58+Change+Log
http://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.