CPanel Multiple Cross-Site Scripting Vulnerabilities BugTraq ID: 20683

[dlennon]

1. CPanel Multiple Cross-Site Scripting Vulnerabilities
BugTraq ID: 20683
Remote: Yes
Last Updated: 2006-10-24
Relevant URL: http://www.securityfocus.com/bid/20683
Summary:
cPanel is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

cPanel version 10.9.0 is vulnerable; other versions may also be affected.



Any info on what update has been released, how about a security forum dedicated to these types of issues? Just a suggestion.....

-Damian

[randomuser]

I believe these have been addressed in CURRENT:

http://changelog.cpanel.net/

[nyjimbo]

Sounds like a blanket statement of the whole Cpanel environment. Hope they are wrong.

[dlennon]

I believe these have been addressed in CURRENT:

http://changelog.cpanel.net/

I see what you are referancing, it mentioned CentOS spicificly, can we get any confermation from cPanel that this has been resolved for other host OS?

-Damian

[pjman]

It was fixed in 56. So, if you're running Build 56 and up, you're cool!

The former exploit required authentication, too! So, it was only local.