Cpanel 11.X Edit E-mail Cross Site Request Forgery exploit

[ASTRAPI]

A new exploit is out a few hours ago

Cpanel 11.X Edit E-mail Cross Site Request Forgery exploit

How can i protect from this?

I do not use cpanel emails at all as i have only one account and i use a gmail account and not [email protected] account.....

What a user can do with this and how can i identify it?

I am using ssl also on the whm login... Does that helps on this case?

Thank you

 

[cPanelNick]

Please enable security tokens. This is effective at preventing this type of attack.

http://docs.cpanel.net/twiki/pub/AllDocumentation/ReleaseNotes/recommended_settings.pdf

 

[ASTRAPI]

Do i have to use the same setting to prevent this on the new 11.28 also?

Or the new version do not extra settings to prevent this?

Thank you

 

[cPanelNick]

11.28 has security tokens enabled by default. see http://docs.cpanel.net/twiki/bin/vi...ReleaseNotes#Security Tokens Enabled by Defau

You will still need to enable them if you upgrade from an older version.