-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

cPanel TSR-2021-0005 Full Disclosure

SEC-595

Summary

Boxtrapper runs with /tmp as the working directory.

Security Rating

cPanel has assigned this vulnerability a CVSSv3.1 score of 3.9 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

Boxtrapper is run with /tmp as the working directory. In combination with the CVE-2021-36770 for Perl's Encode.pm, it is possible for an attacker to execute arbitrary code as another user on the server.

Credits

This issue was discovered by the cPanel Security Team.

Solution

This issue is resolved in the following builds:
11.98.0.8
11.94.0.16

SEC-596

Summary

Reflected XSS Vulnerability in Legacy Login Page.

Security Rating

cPanel has assigned this vulnerability a CVSSv3.1 score of 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

Invalid UTF-8 characters could trigger cPanel to use the Legacy Login page. This page did not adequately encode output. This could allow for an attacker to inject arbitrary JavaScript code into the rendered page.

Credits

This issue was discovered by Sh1yo.

Solution

This issue is resolved in the following builds:
11.98.0.8
11.94.0.16

-----BEGIN PGP SIGNATURE-----

iQJIBAEBCgAyFiEEtnCbTMb0IHf2mEGRlSG+3KvZTd8FAmFKLpgUHHNlY3VyaXR5
QGNwYW5lbC5uZXQACgkQlSG+3KvZTd9tOBAA0zJz+33iOKGdz+PmXdJQ8tFWKcc+
i5Y7YYhfe1fsaOhyDst5ceipwp4se8I0stNzIAlHw9Ld1sNwuF2rDWvJanj+23kJ
/C5es8/0haNNhux5JRQizRrqq1jNn6UzEmql7zzXlq2xNdByKuaP8y/rnyfEPYl6
2gjHNR+JhNlPimM+IJJRKMThI5iYV+FAkuVXZYzrYvZXelYZpR0cZj4+weGXaL8q
LhfrR4WttgeZKTB5NClH1g/WxQoepl2JLxrhyQFSAX3NbNQGsEN6e8pkGIU87xHj
L8W4LXwTfj54viLMBHh0F1w01/21+a99ewC6IFO1euJrPnRn+oNuA9kL9Ovb1Y9m
UJc8Wu/tnOreSE7dlkjwPjxD6PfuU6UfpXOswqswLP1D78tWHEj32ND6fO4gL+vk
0GFCOEdNepLITSl1/z+i1aNuC6IsiamkTUJKBqZr2Prb21wzHV0hGgJsKWb9v8xI
EhmK/4sjG0V4fWsSd/Oi04fHOp0j3lpTyjEd3tJGEnFOcz6jlwL7QBfiqegZwdyk
jLHp6KWXTp5h9Miu/iQMU8s/w7nhm6lKqVOWdEjiLKPeWfFXRQ03PCr1wD42/+wc
U6rWGLf2wDQ4eLoPvD1EHZ61gpv1Jf06WyDO+/G3TIavTPyxE3DXgI5Xq1etgtF4
SiODwmprbslYCcc=
=svgD
-----END PGP SIGNATURE-----