CVE-2017-18398: Input Validation
Published Aug 2, 2019
·Updated
DnsUtils in cPanel before 68.0.15 allows zone creation for hostname and account subdomains (SEC-331).
Affected Software
4 affected components
Cpanel Cpanel>=61.9999.55<62.0.35
Cpanel Cpanel>=63.9999.74<64.0.42
Cpanel Cpanel>=65.9999.38<66.0.34
Cpanel Cpanel>=67.9999.64<68.0.15
Event History
Aug 2, 2019
CVE Published
via MITRE·01:08 PM
Data Sourced
via MITRE·01:08 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-18398?
CVE-2017-18398 is considered a high-severity vulnerability due to the potential for unauthorized DNS zone creation.
2
How do I fix CVE-2017-18398?
To fix CVE-2017-18398, update cPanel to version 68.0.15 or later.
3
What versions of cPanel are affected by CVE-2017-18398?
CVE-2017-18398 affects cPanel versions before 68.0.15, including those in the series from 61.9999.55 to 62.0.35, 63.9999.74 to 64.0.42, and 65.9999.38 to 66.0.34.
4
What impacts does CVE-2017-18398 have on cPanel users?
CVE-2017-18398 allows attackers to create unauthorized DNS zones for hostnames and subdomains, compromising domain management.
5
Is there a workaround for CVE-2017-18398 if I can't update immediately?
There are no official workarounds for CVE-2017-18398; the recommended action is to apply the software update.