CVE-2017-18428: Infoleak
Published Aug 2, 2019
·Updated
In cPanel before 66.0.2, Apache HTTP Server domlogs become temporarily world-readable during log processing (SEC-290).
Affected Software
6 affected components
Cpanel Cpanel>=55.9999.61<56.0.51
Cpanel Cpanel>=57.9999.48<58.0.52
Cpanel Cpanel>=59.9999.58<60.0.45
Cpanel Cpanel>=61.9999.55<62.0.27
Cpanel Cpanel>=63.9999.74<64.0.33
Cpanel Cpanel>=65.9999.38<66.0.2
Event History
Aug 2, 2019
CVE Published
via MITRE·03:47 PM
Data Sourced
via MITRE·03:47 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-18428?
CVE-2017-18428 has a medium severity rating due to the potential exposure of log files to unauthorized users.
2
How do I fix CVE-2017-18428?
To fix CVE-2017-18428, upgrade to cPanel version 66.0.2 or later, where the issue is resolved.
3
Which versions are affected by CVE-2017-18428?
CVE-2017-18428 affects cPanel versions prior to 66.0.2, including several versions between 55 and 66.
4
What types of systems are impacted by CVE-2017-18428?
CVE-2017-18428 impacts systems running cPanel prior to version 66.0.2 that utilize Apache HTTP Server for log processing.
5
Is there a workaround for CVE-2017-18428?
There is no known workaround for CVE-2017-18428; the only solution is to upgrade to the fixed version.