CRSF leak

[rachweb]

On defcon there was a presentation about CRSF leak.
Cpanel was one of the companies in that presentation that has CRSF.

For more information see at cPanel, Netgear and Linksys susceptible to nasty attack • The Register.

What will do Cpanel about this and needs in my opinion they must bring immediately fix for it.

[Wenters.com]

Isn't this CRSF Leak only applicable to the JSON-API? Which is only available in 11.25 and up? So if I stay with 11.24 for a while, I should be save?

[rachweb]

Isn't this CRSF Leak only applicable to the JSON-API? Which is only available in 11.25 and up? So if I stay with 11.24 for a while, I should be save?

Yes it is indeed the JSON-API, but it's also affecting 11.24.
In their demo was the version 11.24.4

[cpanelkenneth]

We should have a statement on this later today.

[MattUK]

Hi Kenneth,

Will this by on the web site or in the forum?

Thanks,

Matt.

[cpanelnick]

cPanel Security Update: CSRF (cross-site request forgery) - cPanel Inc.

[consultorpc]

Can we downgrade easily to 11.24 ?

[cPanelDavidG]

Can we downgrade easily to 11.24 ?

Version 11.24 is the latest version of cPanel/WHM currently available. Version 11.25 is not yet available.