SB2019051312 - Cross-site scripting in CentOS Web Panel
Published: May 13, 2019 Updated: August 8, 2020
Security Bulletin ID
SB2019051312
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Cross-site scripting (CVE-ID: CVE-2019-11429)
The vulnerability allows a remote privileged user to read and manipulate data.
CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version), 0.9.8.753 (Pro) and 0.9.8.807 (Pro) is vulnerable to Reflected XSS for the "Domain" field on the "DNS Functions > "Add DNS Zone" screen.
Remediation
Install update from vendor's website.