CVE-2017-18436: Infoleak
Published Aug 2, 2019
·Updated
cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call (SEC-239).
Affected Software
5 affected components
Cpanel Cpanel>=55.9999.61<56.0.49
Cpanel Cpanel>=57.9999.48<58.0.49
Cpanel Cpanel>=59.9999.58<60.0.43
Cpanel Cpanel>=61.9999.55<62.0.24
Cpanel Cpanel>=63.9999.74<64.0.21
Event History
Aug 2, 2019
CVE Published
via MITRE·04:13 PM
Data Sourced
via MITRE·04:13 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-18436?
CVE-2017-18436 has a moderate severity rating as it allows unauthorized access to files by demo accounts.
2
How do I fix CVE-2017-18436?
To fix CVE-2017-18436, upgrade your cPanel version to 64.0.21 or later.
3
What impact does CVE-2017-18436 have on cPanel users?
CVE-2017-18436 can lead to sensitive file disclosure for demo accounts within affected cPanel versions.
4
Which versions of cPanel are affected by CVE-2017-18436?
CVE-2017-18436 affects cPanel versions prior to 64.0.21, specifically versions 55.9999.61 to 56.0.49, 57.9999.48 to 58.0.49, 59.9999.58 to 60.0.43, 61.9999.55 to 62.0.24, and 63.9999.74 to 64.0.21.
5
Is there a patch available for CVE-2017-18436?
Yes, the patch for CVE-2017-18436 is included in the cPanel update to version 64.0.21.