SB2023120105 - Multiple vulnerabilities in cPanel EasyApache

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023120105

SB2023120105 - Multiple vulnerabilities in cPanel EasyApache

Published: December 1, 2023

Security Bulletin ID SB2023120105
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 33% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Resource management error (CVE-ID: CVE-2023-5678)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources within DH_generate_key() and DH_check_pub_key() functions. A remote attacker can pass specially crafted data to the application and perform a denial of service (DoS) attack.


2) Off-by-one (CVE-ID: CVE-2023-47038)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an off-by-one error when processing regular expressions. A remote attacker can trigger an off-by-one error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


3) Untrusted search path (CVE-ID: CVE-2023-47039)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to usage of an untrusted search path. An attacker with limited privileges can exploit this behavior by placing cmd.exe in locations with weak permissions, such as C:\ProgramData.

The vulnerability affects Windows installations only.


Remediation

Install update from vendor's website.

References