CVE-2018-20895: Input Validation
Published Aug 1, 2019
·Updated
In cPanel before 71.9980.37, API tokens retain ACLs after those ACLs are removed from the corresponding accounts (SEC-393).
Affected Software
3 affected components
Cpanel Cpanel>=67.9999.64<68.0.39
Cpanel Cpanel>=69.9999.122<70.0.43
Cpanel Cpanel>=71.9980.30<71.9980.37
Event History
Aug 1, 2019
CVE Published
via MITRE·01:40 PM
Data Sourced
via MITRE·01:40 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-20895?
CVE-2018-20895 is considered a medium severity vulnerability due to its potential impact on access controls.
2
How do I fix CVE-2018-20895?
To fix CVE-2018-20895, you should upgrade your cPanel installation to version 71.9980.37 or later.
3
What software is affected by CVE-2018-20895?
CVE-2018-20895 affects specific versions of cPanel, particularly versions prior to 71.9980.37, as well as certain ranges in versions 67 and 70.
4
What is the impact of CVE-2018-20895?
The impact of CVE-2018-20895 allows API tokens to retain old access control lists (ACLs) even after the associated ACLs have been removed, potentially leading to unauthorized access.
5
When was CVE-2018-20895 disclosed?
CVE-2018-20895 was disclosed on November 28, 2018.