CVE-2004-1875 Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to testfile.html, (2) file parameter t...
HighCVSS 9.3
EPSS 4.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to testfile.html, (2) file parameter to erredit.html, (3) dns parameter to dnslook.html, (4) account parameter to ignorelist.html, (5) account parameter to showlog.html, (6) db parameter to repairdb.html, (7) login parameter to doaddftp.html (8) account parameter to editmsg.htm, or (9) ip parameter to del.html. NOTE: the dnslook.html vector was later reported to exist in cPanel 10.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cpanel | = 9.1.0_r85 | No fix listed |
References
- 20040330 Exensive cPanel Cross Site Scripting mailing-list
- 11244 patch third-party-advisory vendor-advisory
- 22984 third-party-advisory vendor-advisory
- www.aria-security.com
- www.cirt.net patch vendor-advisory
- 4208 vdb-entry vendor-advisory
- 4209 vdb-entry vendor-advisory
- 4210 vdb-entry vendor-advisory
- 4211 vdb-entry
- 4212 vdb-entry vendor-advisory
- 4213 vdb-entry vendor-advisory
- 4214 vdb-entry vendor-advisory
- 4215 vdb-entry vendor-advisory
- 4243 vdb-entry vendor-advisory
- 10002 vdb-entry vendor-advisory
- 21142 vdb-entry
- ADV-2006-4658 vdb-entry vendor-advisory
- cpanel-multiple-scripts-xss(15671) vdb-entry