CVE-2004-2308: XSS
Published Dec 31, 2004
·Updated
Cross-site scripting (XSS) vulnerability in cPanel 9.1.0 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the dir parameter in dohtaccess.html.
Affected Software
12 affected components
Cpanel Cpanel=5.0
Cpanel Cpanel=5.3
Cpanel Cpanel=6.0
Cpanel Cpanel=6.2
Cpanel Cpanel=6.4
Cpanel Cpanel=6.4.1
Cpanel Cpanel=6.4.2
Cpanel Cpanel=6.4.2_stable_48
Cpanel Cpanel=7.0
Cpanel Cpanel=8.0
Cpanel Cpanel=9.0
Cpanel Cpanel=9.1
Event History
Dec 31, 2004
CVE Published
05:00 AM
Aug 16, 2005
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-2308?
CVE-2004-2308 is considered to be of medium severity due to its impact on web application security.
2
How do I fix CVE-2004-2308?
To fix CVE-2004-2308, upgrade cPanel to version 9.1.1 or later, which addresses the XSS vulnerability.
3
What types of attacks are possible with CVE-2004-2308?
CVE-2004-2308 allows attackers to execute arbitrary web scripts or HTML, leading to potential data theft or session hijacking.
4
Which versions of cPanel are affected by CVE-2004-2308?
CVE-2004-2308 affects cPanel versions 5.0 through 9.1.0.
5
Is my cPanel installation vulnerable if I use versions earlier than 9.1.1?
Yes, if you are using cPanel versions earlier than 9.1.1, your installation is vulnerable to CVE-2004-2308.