CVE-2004-1875: XSS
Multiple cross-site scripting (XSS) vulnerabilities in cPanel 9.1.0-R85 allow remote attackers to inject arbitrary web script or HTML via the (1) email parameter to testfile.html, (2) file parameter to erredit.html, (3) dns parameter to dnslook.html, (4) account parameter to ignorelist.html, (5) account parameter to showlog.html, (6) db parameter to repairdb.html, (7) login parameter to doaddftp.html (8) account parameter to editmsg.htm, or (9) ip parameter to del.html. NOTE: the dnslook.html vector was later reported to exist in cPanel 10.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2004-1875?
CVE-2004-1875 is classified as a medium severity vulnerability due to multiple cross-site scripting (XSS) issues that can be exploited by remote attackers.
How do I fix CVE-2004-1875?
To fix CVE-2004-1875, upgrade to a patched version of cPanel that addresses these cross-site scripting vulnerabilities.
What are the affected software versions for CVE-2004-1875?
CVE-2004-1875 specifically affects cPanel version 9.1.0-R85.
Can CVE-2004-1875 be exploited remotely?
Yes, CVE-2004-1875 can be exploited remotely, allowing attackers to inject arbitrary web scripts or HTML.
What impact does exploiting CVE-2004-1875 have?
Exploitation of CVE-2004-1875 can lead to unauthorized access to sensitive user data and session hijacking.