Open redirect in cPanel - CVE-2017-5614
Published: March 3, 2017 / Updated: July 18, 2020
Vulnerability identifier: #VU31443
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2017-5614
CWE-ID: CWE-601
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: cPanel, Inc
Affected software:
cPanel
cPanel
Detailed vulnerability description
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the (1) success or (2) failure parameter.
How to mitigate CVE-2017-5614
Install update from vendor's website.