CVE-2018-20904: Medium severity cpanel vulnerability
Published Aug 1, 2019
·Updated
cPanel before 71.9980.37 allows attackers to make API calls that bypass the cron feature restriction (SEC-427).
Affected Software
3 affected components
Cpanel Cpanel>=61.9999.55<62.0.47
Cpanel Cpanel>=67.9999.64<68.0.39
Cpanel Cpanel>=69.9999.122<70.0.43
Event History
Aug 1, 2019
CVE Published
via MITRE·02:23 PM
Data Sourced
via MITRE·02:23 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-20904?
CVE-2018-20904 is classified as a high severity vulnerability due to its potential to allow unauthorized API calls.
2
How do I fix CVE-2018-20904?
To fix CVE-2018-20904, update your cPanel installation to version 71.9980.37 or later.
3
What versions of cPanel are affected by CVE-2018-20904?
CVE-2018-20904 affects cPanel versions before 71.9980.37, specifically versions within 61.9999.55 to 62.0.47, 67.9999.64 to 68.0.39, and 69.9999.122 to 70.0.43.
4
Can CVE-2018-20904 be exploited remotely?
Yes, CVE-2018-20904 can be exploited remotely by attackers to bypass the cron feature restrictions.
5
What implications does CVE-2018-20904 have for my web server's security?
CVE-2018-20904 poses a significant security risk as it allows attackers to execute unauthorized scheduled tasks on your web server.