CVE-2017-18425
First published: Fri Aug 02 2019(Updated: )
In cPanel before 66.0.2, the cpdavd_error_log file can be created with weak permissions (SEC-280).
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| cPanel | >=56.0.1<56.0.51 | |
| cPanel | >=58.0.3<58.0.52 | |
| cPanel | >=60.0.3<60.0.45 | |
| cPanel | >=62.0.1<62.0.27 | |
| cPanel | >=64.0.0<64.0.33 | |
| cPanel | >=66.0.1<66.0.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-18425?
CVE-2017-18425 is considered a medium severity vulnerability due to weak file permissions that may lead to unauthorized access.
How do I fix CVE-2017-18425?
To fix CVE-2017-18425, upgrade cPanel to version 66.0.2 or later where the permissions issue has been resolved.
Which versions of cPanel are affected by CVE-2017-18425?
CVE-2017-18425 affects cPanel versions prior to 66.0.2, including versions 56.0.1 to 56.0.51, 58.0.3 to 58.0.52, 60.0.3 to 60.0.45, 62.0.1 to 62.0.27, and 64.0.0 to 64.0.33.
What are the potential impacts of CVE-2017-18425?
The potential impact of CVE-2017-18425 includes the risk of unauthorized users gaining access to sensitive log files due to improper permissions.
Is there a workaround for CVE-2017-18425?
While upgrading is the recommended action, a temporary workaround may involve manually changing the permissions of the cpdavd_error_log file to prevent unauthorized access.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cpanel
- canonical/cpanel
- version/cpanel/56.0.1
- version/cpanel/58.0.3
- version/cpanel/60.0.3
- version/cpanel/62.0.1
- version/cpanel/64.0.0
- version/cpanel/66.0.1