In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/account_new_create&acc=guadaapi URI. Any number of %00 instances can be used, e.g., .%00%00%00./.%00%00%00./api/account_new_create could also be used for the scripts parameter.
References
| Link | Resource |
|---|---|
| https://control-webpanel.com/changelog | Release Notes Vendor Advisory |
| https://octagon.net/blog/2022/01/22/cve-2021-45467-cwp-centos-web-panel-preauth-rce/ | Exploit Third Party Advisory |
Configurations
History
24 Jan 2023, 18:57
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Control-webpanel
Control-webpanel webpanel |
|
| CPE | cpe:2.3:a:control-webpanel:webpanel:*:*:*:*:*:*:*:* |
05 Jan 2023, 20:54
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | NVD-CWE-noinfo | |
| CPE | cpe:2.3:a:centos-webpanel:centos_web_panel:*:*:*:*:*:*:*:* | |
| First Time |
Centos-webpanel
Centos-webpanel centos Web Panel |
|
| References | (MISC) https://octagon.net/blog/2022/01/22/cve-2021-45467-cwp-centos-web-panel-preauth-rce/ - Exploit, Third Party Advisory | |
| References | (MISC) https://control-webpanel.com/changelog - Release Notes, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
26 Dec 2022, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-12-26 05:15
Updated : 2023-12-10 14:48
NVD link : CVE-2021-45467
Mitre link : CVE-2021-45467
CVE.ORG link : CVE-2021-45467
JSON object : View
Products Affected
control-webpanel
- webpanel
CWE