CVE-2004-1603 — MEDIUM (5.5)

Vulnerability Description

cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled.

CVSS Score

5.5

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Cpanel	Cpanel	9.4.1

Related Weaknesses (CWE)

CWE-59

References

http://marc.info/?l=bugtraq&m=109811572123753&w=2Mailing List
http://marc.info/?l=bugtraq&m=109811654104208&w=2Mailing List
http://secunia.com/advisories/12865Broken LinkExploitPatch
http://www.securityfocus.com/bid/11449Broken LinkExploitPatch
http://www.securityfocus.com/bid/11455Broken LinkExploitPatch
https://exchange.xforce.ibmcloud.com/vulnerabilities/17779Third Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/17780Third Party AdvisoryVDB Entry
http://marc.info/?l=bugtraq&m=109811572123753&w=2Mailing List
http://marc.info/?l=bugtraq&m=109811654104208&w=2Mailing List
http://secunia.com/advisories/12865Broken LinkExploitPatch
http://www.securityfocus.com/bid/11449Broken LinkExploitPatch
http://www.securityfocus.com/bid/11455Broken LinkExploitPatch
https://exchange.xforce.ibmcloud.com/vulnerabilities/17779Third Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/17780Third Party AdvisoryVDB Entry

FAQ

What is CVE-2004-1603?

CVE-2004-1603 is a vulnerability with a CVSS score of 5.5 (MEDIUM). cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file when Front Page extensions a...

How severe is CVE-2004-1603?

CVE-2004-1603 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2004-1603?

Check the references section above for vendor advisories and patch information. Affected products include: Cpanel Cpanel.