« Volver al listado

CVE-2003-0521

Estado: ModificadaMedia (6.8)—💥 Exploit

Cross-site scripting (XSS) vulnerability in cPanel 6.4.2 allows remote attackers to insert arbitrary HTML and possibly gain cPanel administrator privileges via script in a URL that is logged but not properly quoted when displayed via the (1) Error Log or (2) Latest Visitors screens.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Tecnologías afectadas (1)

Cpanel — Cpanel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2003-0521",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": true,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2003-08-18T04:00:00.000",
  "references": [
    {
      "url": "http://marc.info/?l=bugtraq&m=105760556627616&w=2",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://marc.info/?l=bugtraq&m=105760556627616&w=2",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in cPanel 6.4.2 allows remote attackers to insert arbitrary HTML and possibly gain cPanel administrator privileges via script in a URL that is logged but not properly quoted when displayed via the (1) Error Log or (2) Latest Visitors screens."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de secuenicias de comandos en sitios cruzados (XSS) en cPanel 6.4.2 permite a atacantes remotos insertar HTML arbitrario y posiblemente ganar privilegios de adminstrador de cPanel mediante código en una URL que es registrada pero no entrecomillada adecuadamente cuando se visualiza mediante el Registro de Errores o la pantalla de Últimos Visitantes."
    }
  ],
  "lastModified": "2026-06-16T22:02:21.617",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cpanel:cpanel:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E5B33AE8-75A8-4454-A1A3-33F4034015FC"
            },
            {
              "criteria": "cpe:2.3:a:cpanel:cpanel:5.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4394768-37BE-4FC5-A65A-28C0295A33B6"
            },
            {
              "criteria": "cpe:2.3:a:cpanel:cpanel:6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC52A018-43E8-4D86-A84C-81064B6ACD74"
            },
            {
              "criteria": "cpe:2.3:a:cpanel:cpanel:6.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2FC66D8D-01B8-4312-A311-ACAB43699071"
            },
            {
              "criteria": "cpe:2.3:a:cpanel:cpanel:6.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E892FB52-DB84-422F-ABB6-29AB95726138"
            },
            {
              "criteria": "cpe:2.3:a:cpanel:cpanel:6.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1FC5C591-69F3-411F-A53A-72D17687CA2E"
            },
            {
              "criteria": "cpe:2.3:a:cpanel:cpanel:6.4.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "92D81000-1A7C-4465-9EE2-E651AED09F82"
            },
            {
              "criteria": "cpe:2.3:a:cpanel:cpanel:6.4.2_stable_48:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4B555B5-E66F-4E37-A5BC-E04CBDFA4F8B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "evaluatorSolution": "This vulnerability is addressed in the following product release:\r\ncPanel, cPanel, 7.0"
}