SB2019082118 - Multiple vulnerabilities in CentOS Web Panel

Main Vulnerability Database SB2019082118

SB2019082118 - Multiple vulnerabilities in CentOS Web Panel

Published: August 21, 2019 Updated: August 8, 2020

Security Bulletin ID SB2019082118

Severity

Medium

Patch available

YES

Number of vulnerabilities 12

Exploitation vector Remote access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 12 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2019-14724)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to edit an e-mail forwarding destination of a victim's account via an attacker account.

2) Input validation error (CVE-ID: CVE-2019-14725)

The vulnerability allows a remote authenticated user to manipulate data.

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail usage value of a victim account via an attacker account.

3) Input validation error (CVE-ID: CVE-2019-14721)

The vulnerability allows a remote authenticated user to manipulate data.

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to remove a target user from phpMyAdmin via an attacker account.

4) Input validation error (CVE-ID: CVE-2019-14722)

The vulnerability allows a remote authenticated user to manipulate data.

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete an e-mail forwarding destination from a victim's account via an attacker account.

5) Input validation error (CVE-ID: CVE-2019-14723)

The vulnerability allows a remote authenticated user to manipulate data.

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a victim's e-mail account via an attacker account.

6) Input validation error (CVE-ID: CVE-2019-14726)

The vulnerability allows a remote authenticated user to read and manipulate data.

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to access and delete DNS records of a victim's account via an attacker account.

7) Input validation error (CVE-ID: CVE-2019-14727)

The vulnerability allows a remote authenticated user to manipulate data.

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to change the e-mail password of a victim account via an attacker account.

8) Input validation error (CVE-ID: CVE-2019-14728)

The vulnerability allows a remote authenticated user to manipulate data.

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to add an e-mail forwarding destination to a victim's account via an attacker account.

9) Input validation error (CVE-ID: CVE-2019-14729)

The vulnerability allows a remote authenticated user to manipulate data.

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a sub-domain from a victim's account via an attacker account.

10) Input validation error (CVE-ID: CVE-2019-14730)

The vulnerability allows a remote authenticated user to manipulate data.

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete a domain from a victim's account via an attacker account.

11) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-14245)

The vulnerability allows a remote authenticated user to manipulate data.

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to delete databases (such as oauthv2) from the server via an attacker account.

12) Credentials management (CVE-ID: CVE-2019-14246)

The vulnerability allows a remote authenticated user to gain access to sensitive information.

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to discover phpMyAdmin passwords (of any user in /etc/passwd) via an attacker account.

Remediation

Install update from vendor's website.

References