Lucene search

[email protected]CVE-2020-29136

HistoryNov 27, 2020 - 2:15 a.m.

CVE-2020-29136

2020-11-2702:15:00

CWE-307

[email protected]

web.nvd.nist.gov

cpanel

2fa

bypass

vulnerability

sec-575

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.8 Medium

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

43.5%

JSON

In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575).

CPENameOperatorVersion
cpanel:cpanelcpanellt11.92.0.2
cpanel:cpanelcpanellt11.90.0.17
cpanel:cpanelcpanellt11.86.0.32

CPE	Name	Operator	Version
cpanel:cpanel	cpanel	lt	11.92.0.2
cpanel:cpanel	cpanel	lt	11.90.0.17
cpanel:cpanel	cpanel	lt	11.86.0.32

References

docs.cpanel.net/changelogs/90-change-log/

news.cpanel.com/cpanel-tsr-2020-0007-full-disclosure/

www.digitaldefense.com/news/zero-day-cpanel-and-webhost-manager/

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6.8 Medium

AI Score

Confidence

Low

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

43.5%

JSON

Related for CVE-2020-29136

prion2 cvelist1 cve1