Categories: cPanelSecurity

cPanel team releases security patches for 20 critical vulnerabilities

 

 

The cPanel security team has identified several security concerns in their control panel software. They have released patches to address all these security concerns with the cPanel and WHM product.  This patch addresses 20 vulnerabilities in cPanel & WHM software versions 11.54, 11.52, 11.50, and 11.48. The patches include following vulnerability fix

  1. Arbitrary code execution via unsafe @INC path.
  2. SQL injection vulnerability in bin/horde_update_usernames.
  3. Arbitrary code execution vulnerability during locale duplication.
  4. Password hashes revealed by bin/mkvhostspasswd script.
  5. Limited arbitrary file read in bin/setup_global_spam_filter.pl.
  6. Code execution as shared users via JSON-API.
  7. Password hash revealed by chcpass script.
  8. Arbitrary file overwrite in scripts/check_system_storable.
  9. Arbitrary file chown/chmod during Roundcube database conversions.
  10. Arbitrary file read and write via scripts/fixmailboxpath.
  11. Arbitrary file overwrite in scripts/quotacheck.
  12. Limited arbitrary file chmod in scripts/secureit.
  13. Arbitrary code execution via scripts/synccpaddonswithsqlhost.
  14. Self-XSS in WHM PHP Configuration editor interface.
  15. Missing ACL enforcement in AppConfig subsystem.
  16. Stored XSS in WHM Feature Manager interface.
  17. Self-XSS in X3 Entropy Banner interface.
  18. Unauthenticated arbitrary code execution via cpsrvd.

For more details regarding this announcement, please check the following article:

https://forums.cpanel.net/threads/cpanel-tsr-2016-0001-announcement.520741/

 

To update the cPanel to latest  version  follow below steps :

Login to server via Shell  and run below command in screen .

#/scripts/upcp –force

 

Stay Secure!


Vishwajit Kale
Vishwajit Kale blazed onto the digital marketing scene back in 2015 and is the digital marketing strategist of Hostripples, a company that aims to provide affordable web hosting solutions. Vishwajit is experienced in digital and content marketing along with SEO. He's fond of writing technology blogs, traveling and reading.

Recent Posts

AI – Powered Customer Support in Hosting: Chatbots & Virtual Assistants

Customer support has always been the backbone of the web hosting industry. From helping users set up domains to troubleshooting…

2 weeks ago

ChatGPT: Your Ultimate AI Content Generation Tool

Content is the most vital asset for businesses navigating the digital era. But creating high-quality, engaging content consistently can be…

4 weeks ago

Discover Ollama: How It Works, Features & Everything?

Welcome to the exciting world of Ollama, a revolutionary open-source tool that's democratizing access to Large Language Models (LLMs). If…

1 month ago

Connecting to Amazon EC2 via WinSCP (SFTP): A Complete Guide

Managing files on your Amazon EC2 instances can often feel like navigating a complex maze, especially when you prefer a…

2 months ago

How Can I Connect to a Database with MySQL Workbench?

Welcome to the world of database management with MySQL Workbench! If you're new to databases or looking for a powerful,…

2 months ago