CVE-2017-18450: SQL Injection
Published Aug 2, 2019
·Updated
cPanel before 64.0.21 allows certain file-chmod operations via /scripts/convertroundcubemysql2sqlite (SEC-255).
Affected Software
5 affected components
Cpanel Cpanel>=55.9999.61<56.0.49
Cpanel Cpanel>=57.9999.48<58.0.49
Cpanel Cpanel>=59.9999.58<60.0.43
Cpanel Cpanel>=61.9999.55<62.0.24
Cpanel Cpanel>=63.9999.74<64.0.21
Event History
Aug 2, 2019
CVE Published
via MITRE·04:24 PM
Data Sourced
via MITRE·04:24 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-18450?
CVE-2017-18450 is considered a medium severity vulnerability that may allow unauthorized file permission changes.
2
How do I fix CVE-2017-18450?
To fix CVE-2017-18450, update cPanel to version 64.0.21 or later.
3
Which versions of cPanel are affected by CVE-2017-18450?
CVE-2017-18450 affects cPanel versions before 64.0.21, including versions in the 55.x, 56.x, 57.x, 58.x, 59.x, 60.x, 61.x, and 62.x series.
4
What actions are vulnerable due to CVE-2017-18450?
CVE-2017-18450 allows certain file-chmod operations via the /scripts/convert_roundcube_mysql2sqlite script.
5
Is there a workaround for CVE-2017-18450 if I cannot update cPanel?
There is no documented workaround for CVE-2017-18450, and the recommended solution is to apply the necessary updates.