Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2016-10847 Details

cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath (SEC-80).

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:8.1 HIGHVector:CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://documentation.cpanel.net/display/CL/54+Change+Log	CVE	Release NotesVendor Advisory
https://documentation.cpanel.net/display/CL/54+Change+Log	[email protected]	Release NotesVendor Advisory
https://news.cpanel.com/cpanel-tsr-2016-0001-full-disclosure/	[email protected]	Vendor Advisory

CWE-ID	CWE Name	Source
CWE-74	Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')	[email protected]

Product	Versions
cpanel cpanel	>= 11.48.0.5, < 11.48.5.2 >= 11.50.0.4, < 11.50.4.3 >= 11.51.9999.98, < 11.52.2.4 >= 11.54.0.0, < 11.54.0.4
CPE cpe:2.3:a:cpanel:cpanel:::::::: Remediation No remediation found in references.

4 change records found show changes

QUICK INFO