Detections
Analytics
cPanel Front Page Extension Installation Information Disclosure
medium Nessus Network Monitor Plugin ID 2391
Synopsis
The remote host is vulnerable to multiple attack vectors.Description
The remote host is running a version of cPanel that is older or as old as version 9.9.1.The remote version of this software is vulnerable to two flaws :
- An information disclosure flaw if the FrontPage Extension is installed that may allow a local attacker to read arbitrary files on the remote host with the privileges of the 'cpsvrd' process.
- A file ownership problem in the FrontPage Extension that may allow a local attacker to read the content of a .htaccess file ;
Solution
Upgrade or patch according to vendor recommendations.Plugin Details
Severity: Medium
ID: 2391
Family: Web Servers
Published: 11/6/2004
Updated: 3/6/2019
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 6.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 6.2
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:cpanel:cpanel
Reference Information
CVE: CVE-2004-1603