CVE-2017-18455: Medium severity cpanel vulnerability
Published Aug 2, 2019
·Updated
In cPanel before 62.0.17, addon domain conversion did not require a package for resellers (SEC-208).
Affected Software
4 affected components
Cpanel Cpanel>=55.9999.61<56.0.46
Cpanel Cpanel>=57.9999.48<58.0.45
Cpanel Cpanel>=59.9999.58<60.0.39
Cpanel Cpanel>=61.9999.55<62.0.17
Event History
Aug 2, 2019
CVE Published
via MITRE·04:28 PM
Data Sourced
via MITRE·04:28 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-18455?
CVE-2017-18455 has been classified with a medium severity due to the potential impact on reseller privileges.
2
How do I fix CVE-2017-18455?
To address CVE-2017-18455, update cPanel to version 62.0.17 or later.
3
Which versions of cPanel are affected by CVE-2017-18455?
CVE-2017-18455 affects cPanel versions prior to 62.0.17, specifically those in the ranges of 55.x, 56.x, 57.x, 58.x, 59.x, 60.x, and 61.x.
4
What does CVE-2017-18455 exploit?
CVE-2017-18455 exploits the addon domain conversion process which improperly allows resellers to convert domains without required packages.
5
Is there a workaround for CVE-2017-18455?
There are no known workarounds for CVE-2017-18455; patching to the fixed version is the recommended solution.