CVE-2017-18407: Medium severity cpanel vulnerability
Published Aug 2, 2019
·Updated
cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279).
Affected Software
5 affected components
Cpanel Cpanel>=59.9999.58<60.0.48
Cpanel Cpanel>=61.9999.55<62.0.30
Cpanel Cpanel>=63.9999.74<64.0.40
Cpanel Cpanel>=65.9999.38<66.0.23
Cpanel Cpanel>=67.9999.64<67.9999.103
Event History
Aug 2, 2019
CVE Published
via MITRE·01:46 PM
Data Sourced
via MITRE·01:46 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-18407?
CVE-2017-18407 has been assessed as having a moderate severity due to the lack of SSL hostname verification.
2
How do I fix CVE-2017-18407?
To fix CVE-2017-18407, update your cPanel to version 67.9999.103 or later to enforce SSL hostname verification.
3
Which versions of cPanel are affected by CVE-2017-18407?
CVE-2017-18407 affects cPanel versions prior to 67.9999.103 that are within specific version ranges.
4
What are the implications of CVE-2017-18407?
The implications of CVE-2017-18407 include potential man-in-the-middle attacks due to inadequate hostname verification.
5
Is there a workaround for CVE-2017-18407?
No official workaround is recommended for CVE-2017-18407; updating to a secure version is the advised action.