VULNERABILITIES / FIXES - December 26, 2012
by Carol~ - 12/26/12 8:37 AM
cPanel "account" Cross-Site Scripting Vulnerability
Release Date: 2012-12-26
Criticality level : Less critical
Impact : Cross Site Scripting
Where : From remote
Solution Status : Unpatched
Software: cPanel 11.x
A vulnerability has been reported in cPanel, which can be exploited by malicious people to conduct cross-site scripting attacks.
Input passed to the "account" parameter in frontend/x3/mail/manage.html is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
The vulnerability is reported in version 220.127.116.11. Other versions may also be affected.
No official solution is currently available.
Provided and/or discovered by:
Rafay Baloch, RafayHackingArticles