Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2021-35368 |
CWE-ID | CWE-693 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
EasyApache Server applications / Other server solutions |
Vendor | cPanel, Inc |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
EUVDB-ID: #VU54495
Risk: Medium
CVSSv3.1: 5.5 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-35368
CWE-ID:
CWE-693 - Protection Mechanism Failure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to insufficient implementation of security measures within the default CRS ruleset. An attacker can bypass implemented security restrictions and exploit vulnerabilities in the CMS that is protected with ModSecurity with the OWASP ModSecurity Core Rule Set (CRS).
Install update from vendor's website.
Vulnerable software versionsEasyApache: 4 - 4 20201-3-3
External linkshttp://news.cpanel.com/easyapache-4-june-30-release/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.