Vulnerability identifier: #VU36031
Vulnerability risk: Low
CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-79
Exploitation vector: Network
Exploit availability: Yes
Vulnerable software:
CentOS Web Panel
Web applications /
CMS
Vendor: CentOS Web Panel
Description
The vulnerability allows a remote privileged user to read and manipulate data.
CentOS Web Panel (CWP) 0.9.8.789 is vulnerable to Stored/Persistent XSS for the "Name Server 1" and "Name Server 2" fields via a "DNS Functions" "Edit Nameservers IPs" action.
Mitigation
Install update from vendor's website.
Vulnerable software versions
CentOS Web Panel: 0.9.8.789
External links
http://www.securityfocus.com/bid/107769
http://packetstormsecurity.com/files/152303/CentOS-Web-Panel-0.9.8.789-Cross-Site-Scripting.html
http://www.exploit-db.com/exploits/46629
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.