CVE-2004-1769 The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to rese...
HighCVSS 10.0
EPSS 34.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to resetpass.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cpanel | = 5.0 | No fix listed |
| cpanel | = 5.3 | No fix listed |
| cpanel | = 6.0 | No fix listed |
| cpanel | = 6.2 | No fix listed |
| cpanel | = 6.4 | No fix listed |
| cpanel | = 6.4.1 | No fix listed |
| cpanel | = 6.4.2 | No fix listed |
| cpanel | = 6.4.2_stable_48 | No fix listed |
| cpanel | = 7.0 | No fix listed |
| cpanel | = 8.0 | No fix listed |
| cpanel | = 9.0 | No fix listed |
| cpanel | = 9.1 | No fix listed |
References
- 20040311 cPanel Secuirty Advisory CPANEL-2004:01-01 mailing-list
- 11111 third-party-advisory vendor-advisory
- VU#831534 third-party-advisory us-government-resource
- 20040311 Cpanel 8.*.* have a problem ? mailing-list vendor-advisory
- 9848 exploit vdb-entry vendor-advisory
- cpanel-resetpass-execute-commands(15443) vdb-entry