Published: 12/05/2008 Updated: 07/11/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 445

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

The WHM interface 11.15.0 for cPanel 11.18 prior to 11.18.4 and 11.22 prior to 11.22.3 allows remote malicious users to bypass XSS protection and inject arbitrary script or HTML via repeated, improperly-ordered "<" and ">" characters in the (1) issue parameter to scripts2/knowlegebase, (2) user parameter to scripts2/changeip, (3) search parameter to scripts2/listaccts, and other unspecified vectors.

Vulnerable Product	Search on Vulmon	Subscribe to Product
cpanel cpanel 11.18
cpanel cpanel 11.22
cpanel cpanel 11.18.3
cpanel cpanel 11.18.1
cpanel cpanel 11.22.1
cpanel cpanel 11.22.2
cpanel cpanel 11.18.2

cPanel versions below 11184 and 11223 suffer from cross site scripting and cross site request forgery vulnerabilities ...

source: wwwsecurityfocuscom/bid/29125/info cPanel is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site This may ...

source: wwwsecurityfocuscom/bid/29125/info cPanel is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site This may hel ...

source: wwwsecurityfocuscom/bid/29125/info cPanel is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site This may h ...

CWE-79 http://www.securityfocus.com/bid/29125 http://lists.grok.org.uk/pipermail/full-disclosure/2008-May/062197.html http://secunia.com/advisories/30166 http://securityreason.com/securityalert/3866 http://www.vupen.com/english/advisories/2008/1522/references https://exchange.xforce.ibmcloud.com/vulnerabilities/42305 http://www.securityfocus.com/archive/1/491864/100/0/threaded http://changelog.cpanel.net/?revision=0%3Btree=%3Btreeview=%3Bshow=html%3Bpp=25%3Bte=1314%3Bpg=2 https://nvd.nist.gov https://packetstormsecurity.com/files/66195/cpanel-xssxsrf.txt.html https://www.exploit-db.com/exploits/31773/

CVE-2008-2070

Vulnerability Summary

Exploits

References

Vulmon Search

About

Products

Connect