CVE-2004-0490: High severity Cpanel Cpanel vulnerability
cPanel, when compiling Apache 1.3.29 and PHP with the modphpsuexec option, does not set the --enable-discard-path option, which causes php to use the SCRIPTFILENAME variable to find and execute a script instead of the PATHTRANSLATED variable, which allows local users to execute arbitrary PHP code as other users via a URL that references the attacker's script after the user's script, which executes the attacker's script with the user's privileges, a different vulnerability than CVE-2004-0529.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2004-0490?
The severity of CVE-2004-0490 is considered high due to its potential for local users to execute arbitrary PHP code.
How do I fix CVE-2004-0490?
To fix CVE-2004-0490, ensure that you configure Apache with the --enable-discard-path option when compiling.
Who is affected by CVE-2004-0490?
CVE-2004-0490 affects specific versions of cPanel, especially those prior to 9.1.
What type of vulnerability is CVE-2004-0490?
CVE-2004-0490 is a local file inclusion vulnerability related to PHP execution.
Can CVE-2004-0490 be exploited remotely?
CVE-2004-0490 requires local user access for exploitation, thus is not a remote attack vector.