CVE-2017-18404: Medium severity cpanel vulnerability
Published Aug 2, 2019
·Updated
cPanel before 68.0.15 allows domain data to be deleted for domains with the .lock TLD (SEC-341).
Affected Software
4 affected components
Cpanel Cpanel>=61.9999.55<62.0.35
Cpanel Cpanel>=63.9999.74<64.0.42
Cpanel Cpanel>=65.9999.38<66.0.34
Cpanel Cpanel>=67.9999.64<68.0.15
Event History
Aug 2, 2019
CVE Published
via MITRE·01:12 PM
Data Sourced
via MITRE·01:12 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-18404?
CVE-2017-18404 has a medium severity rating as it allows unauthorized deletion of domain data for specific TLDs.
2
How do I fix CVE-2017-18404?
To fix CVE-2017-18404, update cPanel to version 68.0.15 or later.
3
What versions of cPanel are affected by CVE-2017-18404?
CVE-2017-18404 affects cPanel versions prior to 68.0.15 on specific version ranges.
4
Can CVE-2017-18404 lead to data loss?
Yes, CVE-2017-18404 can result in data loss by allowing deletion of domain data for .lock TLD domains.
5
Is there a workaround for CVE-2017-18404?
There is no official workaround for CVE-2017-18404; applying the software update is the recommended solution.