CVE-2017-18456: XSS
Published Aug 2, 2019
·Updated
cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217).
Affected Software
4 affected components
Cpanel Cpanel>=55.9999.61<56.0.46
Cpanel Cpanel>=57.9999.48<58.0.45
Cpanel Cpanel>=59.9999.58<60.0.39
Cpanel Cpanel>=61.9999.55<62.0.17
Event History
Aug 2, 2019
CVE Published
via MITRE·04:29 PM
Data Sourced
via MITRE·04:29 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-18456?
CVE-2017-18456 is classified as a moderate severity vulnerability due to its self XSS nature.
2
What versions are affected by CVE-2017-18456?
CVE-2017-18456 affects cPanel versions earlier than 62.0.17, including specific versions from 55.x to 61.x.
3
How do I fix CVE-2017-18456?
To fix CVE-2017-18456, upgrade your cPanel installation to version 62.0.17 or later.
4
What type of attack does CVE-2017-18456 allow?
CVE-2017-18456 enables self cross-site scripting (self XSS) attacks within the WHM cPAddons showsecurity interface.
5
Is my server vulnerable if running cPanel before version 62.0.17?
Yes, if your server runs a version of cPanel prior to 62.0.17, it is vulnerable to CVE-2017-18456.