CVE-2017-18412 cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296).
LowCVSS 2.5
EPSS 0.29%
- Published
- Updated
- Exploit status
- No public exploit known
Description
cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cpanel | >= 55.9999.61, < 56.0.52 | 56.0.52 |
| cpanel | >= 59.9999.58, < 60.0.48 | 60.0.48 |
| cpanel | >= 61.9999.55, < 62.0.30 | 62.0.30 |
| cpanel | >= 64.0.0, < 64.0.40 | 64.0.40 |
| cpanel | >= 65.9999.38, < 66.0.23 | 66.0.23 |
| cpanel | >= 67.9999.64, < 67.9999.103 | 67.9999.103 |
References
- documentation.cpanel.net product release-notes
- news.cpanel.com vendor-advisory