« Back to list

CVE-2017-18412

Status: ModifiedLow (2.5)—

cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296).

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Cpanel — Cpanel

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2017-18412",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 1.9,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.4,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 2.5,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-08-02T14:15:13.630",
  "references": [
    {
      "url": "https://documentation.cpanel.net/display/CL/68+Change+Log",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://news.cpanel.com/cpanel-tsr-2017-0005-full-disclosure/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "nvd@nist.gov"
    },
    {
      "url": "https://documentation.cpanel.net/display/CL/68+Change+Log",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "cPanel before 67.9999.103 allows Apache HTTP Server log files to become world-readable because of mishandling on an account rename (SEC-296)."
    },
    {
      "lang": "es",
      "value": "cPanel anterior al versión 67.9999.103, permite que los archivos de registro del Servidor HTTP de Apache sean legibles en todo el mundo debido al manejo inapropiado de un cambio de nombre de cuenta (SEC-296)."
    }
  ],
  "lastModified": "2026-06-17T01:12:48.177",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08B24A9B-F2D3-4282-9270-0A6E3166B726",
              "versionEndExcluding": "56.0.52",
              "versionStartIncluding": "55.9999.61"
            },
            {
              "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C72F220-BEF2-41F6-8312-A5DE70D2E218",
              "versionEndExcluding": "60.0.48",
              "versionStartIncluding": "59.9999.58"
            },
            {
              "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A6F6E962-A1DA-4B7F-9A32-1182DAA065D5",
              "versionEndExcluding": "62.0.30",
              "versionStartIncluding": "61.9999.55"
            },
            {
              "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "179399A2-B445-44BF-BB64-F212CB267EB0",
              "versionEndExcluding": "64.0.40",
              "versionStartIncluding": "64.0.0"
            },
            {
              "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6FDB6E8-4C9D-47B4-90AD-6022D9DD5976",
              "versionEndExcluding": "66.0.23",
              "versionStartIncluding": "65.9999.38"
            },
            {
              "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "07B4EC93-FA39-4633-92FD-B7CA330D3F2D",
              "versionEndExcluding": "67.9999.103",
              "versionStartIncluding": "67.9999.64"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}