CVE-2023-29489

medium · 5.3

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31.

5.3

CVSS

65.5%

EPSS (exploit prob.)

99th

EPSS percentile

2023-04-27

Published

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weaknesses

CWE-79

Affected products

Vendor	Product	Affected versions
cpanel	cpanel	< 11.102.0.31
cpanel	cpanel	>= 11.104.0, < 11.106.0.18
cpanel	cpanel	>= 11.108.0, < 11.108.0.13
cpanel	cpanel	>= 11.109.0, < 11.109.9999.116

Check a specific version with /api/v1/cve/match.

References

https://blog.assetnote.io/2023/04/26/xss-million-websites-cpanel/
https://forums.cpanel.net/threads/cpanel-tsr-2023-0001-full-disclosure.708949/
https://blog.assetnote.io/2023/04/26/xss-million-websites-cpanel/
https://forums.cpanel.net/threads/cpanel-tsr-2023-0001-full-disclosure.708949/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2023-29489