CVE-2006-5883 - Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote authenticated users to

CVE-2006-5883

Summary

Multiple cross-site scripting (XSS) vulnerabilities in cPanel 10 allow remote authenticated users to inject arbitrary web script or HTML via the (1) dir parameter in (a) seldir.html, and the (2) user and (3) dir parameters in (b) newuser.html.

References

http://aria-security.net/advisory/cpanel.txt
http://secunia.com/advisories/22825
http://securityreason.com/securityalert/1847
http://www.osvdb.org/30386
http://www.osvdb.org/30387
http://www.securityfocus.com/archive/1/451374/100/0/threaded
http://www.securityfocus.com/bid/21027
http://www.vupen.com/english/advisories/2006/4500

Vulnerable Configurations

cpe:2.3:a:cpanel:cpanel:10:*:*:*:*:*:*:*
cpe:2.3:a:cpanel:cpanel:10:*:*:*:*:*:*:*

CVSS

Base:	3.5 (as of 17-10-2018 - 21:45)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	SINGLE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:S/C:N/I:P/A:N

refmap via4

bid	21027
bugtraq	20061112 CPanel Multiple Cross Site Scription
misc	http://aria-security.net/advisory/cpanel.txt
osvdb	30386 30387
secunia	22825
sreason	1847
vupen	ADV-2006-4500

Last major update

17-10-2018 - 21:45

Published

14-11-2006 - 19:07

Last modified

17-10-2018 - 21:45