{"id":12902,"date":"2019-07-17T21:06:36","date_gmt":"2019-07-17T21:06:36","guid":{"rendered":"http:\/\/news.cpanel.com\/?p=57287"},"modified":"2019-07-17T21:06:36","modified_gmt":"2019-07-17T21:06:36","slug":"cpanel-tsr-2019-0004-full-disclosure%ef%bb%bf","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cpanel-tsr-2019-0004-full-disclosure%ef%bb%bf\/","title":{"rendered":"cPanel TSR-2019-0004 Full Disclosure\ufeff"},"content":{"rendered":"
\"\"<\/div>\n

Yesterday cPanel released<\/a> new builds for all public update tiers. These updates provide targeted changes to address security concerns with the cPanel & WHM product. Below is the full disclosure of the changes included in that update.<\/p>\n

Information on cPanel\u2019s security ratings is available at https:\/\/go.cpanel.net\/securitylevels<\/a>.<\/p>\n

If your deployed cPanel & WHM servers are configured to automatically update when new releases are available, then no action is required. Your systems will update automatically. If you have disabled automatic updates, then we strongly encourage you to update your cPanel & WHM installations at your earliest convenience.<\/p>\n

SEC-501<\/strong><\/p>\n

Summary
<\/strong>Demo account remote code execution via faulty URI dispatching.
Security Rating
<\/strong>cPanel has assigned this vulnerability a CVSSv3 score of 6.5 CVSS:3.0\/AV:N\/AC:H\/PR:N\/UI:N\/S:C\/C:L\/I:L\/A:L
Description
<\/strong>Errors in the dispatching logic for email autoconfiguration URIs allowed demo accounts to execute functions in the cpanel templating engine that are normally prohibited.
Credits
<\/strong>This issue was discovered by the cPanel Security Team.
Solution
<\/strong>This issue is resolved in the following builds:
11.80.0.22
11.78.0.34<\/p>\n

SEC-504<\/strong><\/p>\n

Summary
<\/strong>Stored-XSS vulnerability in WHM Tomcat Manager interface.
Security Rating
<\/strong>cPanel has assigned this vulnerability a CVSSv3 score of 5.4 CVSS:3.0\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N
Description
<\/strong>The status messages displayed when disabling Tomcat for a cPanel account were not adequately escaped. It was possible for the user to manipulate the content of these status messages. This allowed cPanel accounts to inject arbitrary HTML on the rendered page.
Credits
<\/strong>This issue was discovered by the cPanel Security Team.
Solution
<\/strong>This issue is resolved in the following builds:
11.82.0.2
11.80.0.22
11.78.0.34<\/p>\n

SEC-506<\/strong><\/p>\n

Summary
<\/strong>Self XSS vulnerability in cPanel and webmail master templates.
Security Rating
<\/strong>cPanel has assigned this vulnerability a CVSSv3 score of 4.7 CVSS:3.0\/AV:N\/AC:H\/PR:N\/UI:R\/S:C\/C:L\/I:L\/A:N
Description
<\/strong>All cPanel and webmail interfaces include a username header at the top of the rendered pages. It was possible to manipulate what is displayed in this header by visiting certain non existent webmail accounts. This allowed arbitrary HTML to be injected into the rendered page.
Credits
<\/strong>This issue was discovered by the cPanel Security Team.
Solution
<\/strong>This issue is resolved in the following builds:
11.82.0.2
11.80.0.22
11.78.0.34<\/p>\n

SEC-507<\/strong><\/p>\n

Summary
<\/strong>Unauthenticated file creation vulnerability via Exim log parsing.
Security Rating
<\/strong>cPanel has assigned this vulnerability a CVSSv3 score of 6.8 CVSS:3.0\/AV:N\/AC:H\/PR:N\/UI:N\/S:C\/C:N\/I:H\/A:N
Description
<\/strong>The cPanel Tailwatch daemon determines when to notify an account about excessive email sending by parsing the Exim log. It keeps track of which accounts have been notified using flag files. It was possible to inject data into the Exim log that would cause these flag files to be created in arbitrary locations.
Credits
<\/strong>This issue was discovered by the cPanel Security Team.
Solution
<\/strong>This issue is resolved in the following builds:
11.82.0.2
11.80.0.22
11.78.0.34<\/p>\n

SEC-510<\/strong><\/p>\n

Summary
<\/strong>Root MySQL password revealed to local accounts.
Security Rating
<\/strong>cPanel has assigned this vulnerability a CVSSv3 score of 7.3 CVSS:3.0\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H
Description
<\/strong>A new MySQL password is generated and configured for the root account when no MySQL client configuration file is present during the installation of cPanel & WHM. The code to generate the new password was faulty, leaving some systems with root MySQL passwords that could be discovered by local attackers.
Credits
<\/strong>This issue was discovered by the cPanel Security Team.
Solution
<\/strong>This issue is resolved in the following builds:
11.82.0.2
11.80.0.22<\/p>\n

SEC-512<\/strong><\/p>\n

Summary
<\/strong>Stored-XSS vulnerability in WHM Modify Account interface.
Security Rating
<\/strong>cPanel has assigned this vulnerability a CVSSv3 score of 5.4 CVSS:3.0\/AV:N\/AC:L\/PR:L\/UI:R\/S:C\/C:L\/I:L\/A:N
Description
<\/strong>The status messages displayed when modifying a cPanel account in WHM were not adequately escaped. It was possible for the cPanel account to manipulate the content of these status messages. This allowed an attacker to inject arbitrary HTML on the rendered page.
Credits
<\/strong>This issue was discovered by the cPanel Security Team.
Solution
<\/strong>This issue is resolved in the following builds:
11.82.0.2
11.80.0.22
11.78.0.34<\/p>\n

SEC-514<\/strong><\/p>\n

Summary
<\/strong>Reseller package creation ACLs enforced incorrectly.
Security Rating
<\/strong>cPanel has assigned this vulnerability a CVSSv3 score of 3.3 CVSS:3.0\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:N\/I:L\/A:N
Description
<\/strong>The \u201callow-parkedcreate\u201d and \u201callow-addoncreate\u201d reseller ACLs were not enforced correctly. This allowed a restricted reseller to create packages with parked and addon domain limits exceeding the reseller\u2019s configured limits.
Credits
<\/strong>This issue was discovered by Edwin F Sturt.
Solution
<\/strong>This issue is resolved in the following builds:
11.82.0.2
11.80.0.22
11.78.0.34<\/p>\n

For the PGP-signed message, please see: TSR-2019-0004 Full Disclosure<\/a><\/p>\n

\u0645\u062f\u06cc\u0631\u06cc\u062a \u0633\u0631\u0648\u0631 \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0648 \u0645\u0634\u0627\u0648\u0631\u0647 – \u062b\u0628\u062a \u062f\u0627\u0645\u0646\u0647<\/p>\n","protected":false},"excerpt":{"rendered":"

Yesterday cPanel released new builds for all public update tiers. These updates provide targeted changes to address security concerns with the cPanel & WHM product. Below is the full disclosure of the changes included in that update. Information on cPanel\u2019s security ratings is available at https:\/\/go.cpanel.net\/securitylevels. If your deployed cPanel & WHM servers are configured to automatically update …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25],"tags":[],"class_list":["post-12902","post","type-post","status-publish","format-standard","hentry","category-cpanel-news"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/12902","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=12902"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/12902\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=12902"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=12902"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=12902"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}