CVE-2004-1603

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2004-1603
cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://marc.info/?l=bugtraq&m=109811572123753&w=2 Mailing List
http://marc.info/?l=bugtraq&m=109811654104208&w=2 Mailing List
http://secunia.com/advisories/12865 Broken Link Exploit Patch Vendor Advisory
http://www.securityfocus.com/bid/11449 Broken Link Exploit Patch Third Party Advisory VDB Entry Vendor Advisory
http://www.securityfocus.com/bid/11455 Broken Link Exploit Patch Third Party Advisory VDB Entry Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17779 Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/17780 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:cpanel:cpanel:9.4.1:*:*:*:*:*:*:*
History

26 Jan 2024, 17:06

Type Values Removed Values Added
References () http://marc.info/?l=bugtraq&m=109811572123753&w=2 - () http://marc.info/?l=bugtraq&m=109811572123753&w=2 - Mailing List
References () http://marc.info/?l=bugtraq&m=109811654104208&w=2 - () http://marc.info/?l=bugtraq&m=109811654104208&w=2 - Mailing List
References () http://secunia.com/advisories/12865 - Exploit, Patch, Vendor Advisory () http://secunia.com/advisories/12865 - Broken Link, Exploit, Patch, Vendor Advisory
References () http://www.securityfocus.com/bid/11449 - Exploit, Patch, Vendor Advisory () http://www.securityfocus.com/bid/11449 - Broken Link, Exploit, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
References () http://www.securityfocus.com/bid/11455 - Exploit, Patch, Vendor Advisory () http://www.securityfocus.com/bid/11455 - Broken Link, Exploit, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/17779 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/17779 - Third Party Advisory, VDB Entry
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/17780 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/17780 - Third Party Advisory, VDB Entry
CPE cpe:2.3:a:cpanel:cpanel:9.4.1_r64:*:*:*:*:*:*:* cpe:2.3:a:cpanel:cpanel:9.4.1:*:*:*:*:*:*:*
CWE NVD-CWE-Other CWE-59
CVSS v2 : 5.0
v3 : unknown 		v2 : 5.0
v3 : 5.5
Information

Published : 2004-10-18 04:00

Updated : 2024-01-26 17:06

NVD link : CVE-2004-1603

Mitre link : CVE-2004-1603

CVE.ORG link : CVE-2004-1603

JSON object : View

Products Affected

cpanel

  • cpanel
CWE
CWE-59

Improper Link Resolution Before File Access ('Link Following')