CVE-2003-1426: Low severity Cpanel Cpanel vulnerability
Openwebmail in cPanel 5.0, when run using suid Perl, adds the directory in the SCRIPTFILENAME environment variable to Perl's @INC include array, which allows local users to execute arbitrary code by modifying SCRIPTFILENAME to reference a directory containing a malicious openwebmail-shared.pl executable.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2003-1426?
CVE-2003-1426 is considered a critical vulnerability due to its potential for local users to execute arbitrary code.
How do I fix CVE-2003-1426?
To fix CVE-2003-1426, update to a non-suid version of Openwebmail or apply proper configurations to restrict access.
Who is affected by CVE-2003-1426?
CVE-2003-1426 affects users running Openwebmail in cPanel 5.0 with suid Perl enabled.
What types of attacks can CVE-2003-1426 facilitate?
CVE-2003-1426 can facilitate local code execution attacks by allowing users to inject malicious scripts via the SCRIPT_FILENAME environment variable.
When was CVE-2003-1426 discovered?
CVE-2003-1426 was discovered in early 2003, highlighting vulnerabilities in older versions of Openwebmail.