cPanel has released its Targeted Security Release to address security concerns with the cPanel product. These updates are currently available to all customers via the standard update system.
cPanel has rated this update as having a CVSSv3.1 score of 3.9 to 5.3. For more information on ratings, please visit our documentation.
If you have disabled cPanel & WHM automatic updates, please update your cPanel & WHM installations at your earliest convenience.
If you have configured cPanel & WHM servers to automatically update, no action is required. Your servers have automatically been updated.
To avoid service interruptions, please ensure you are on one of the following secure versions:
Summary
Boxtrapper runs with /tmp as the working directory.
Security Rating
cPanel has assigned this vulnerability a CVSSv3.1 score of 3.9 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Description
Boxtrapper is run with /tmp as the working directory. In combination with the CVE-2021-36770 for Perl’s Encode.pm, it is possible for an attacker to execute arbitrary code as another user on the server.
Credits
This issue was discovered by the cPanel Security Team.
Solution
This issue is resolved in the following builds:
11.98.0.8
11.94.0.16
Summary
Reflected XSS Vulnerability in Legacy Login Page.
Security Rating
cPanel has assigned this vulnerability a CVSSv3.1 score of 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Description
Invalid UTF-8 characters could trigger cPanel to use the Legacy Login page. This page did not adequately encode output. This could allow for an attacker to inject arbitrary JavaScript code into the rendered page.
Credits
This issue was discovered by Sh1yo.
Solution
This issue is resolved in the following builds:
11.98.0.8
11.94.0.16
For the latest information on cPanel & WHM releases, please visit our cPanel Downloads page.
For more information on the cPanel & WHM Versions and Release Process, please refer to our documentation.
For the PGP-Signed message please see TSR-2021-0005.disclosure.signed.