CVE-2017-18395: Input Validation
Published Aug 2, 2019
·Updated
cPanel before 68.0.15 does not block a username of ssl (SEC-328).
Affected Software
4 affected components
Cpanel Cpanel>=61.9999.55<62.0.35
Cpanel Cpanel>=63.9999.74<64.0.42
Cpanel Cpanel>=65.9999.38<66.0.34
Cpanel Cpanel>=67.9999.64<68.0.15
Event History
Aug 2, 2019
CVE Published
via MITRE·01:05 PM
Data Sourced
via MITRE·01:05 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-18395?
CVE-2017-18395 has a medium severity rating due to the potential for unauthorized access using the insecure username 'ssl'.
2
How do I fix CVE-2017-18395?
To fix CVE-2017-18395, upgrade cPanel to version 68.0.15 or later.
3
Which versions of cPanel are affected by CVE-2017-18395?
CVE-2017-18395 affects cPanel versions prior to 68.0.15, specifically versions 61.x.x to 62.x.x, 63.x.x to 64.x.x, and 65.x.x to 66.x.x.
4
Is there a workaround for CVE-2017-18395?
A temporary workaround for CVE-2017-18395 is to avoid using the username 'ssl' for any accounts.
5
What type of vulnerability is CVE-2017-18395?
CVE-2017-18395 is classified as a user creation vulnerability that allows the use of a restricted username.