Cross-site scripting (XSS) vulnerability in cPanel 6.4.2 allows remote attackers to insert arbitrary HTML and possibly gain cPanel administrator privileges via script in a URL that is logged but not properly quoted when displayed via the (1) Error Log or (2) Latest Visitors screens.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cpanel | Cpanel | 5.0 (including) | 5.0 (including) |
| Cpanel | Cpanel | 5.3 (including) | 5.3 (including) |
| Cpanel | Cpanel | 6.0 (including) | 6.0 (including) |
| Cpanel | Cpanel | 6.2 (including) | 6.2 (including) |
| Cpanel | Cpanel | 6.4 (including) | 6.4 (including) |
| Cpanel | Cpanel | 6.4.1 (including) | 6.4.1 (including) |
| Cpanel | Cpanel | 6.4.2 (including) | 6.4.2 (including) |
| Cpanel | Cpanel | 6.4.2_stable_48 (including) | 6.4.2_stable_48 (including) |