CVE Vulnerabilities

CVE-2017-18407

Improper Verification of Cryptographic Signature

Published: Aug 02, 2019 | Modified: Nov 21, 2024
CVSS 3.x
4.8
MEDIUM
Source:
NVD
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 2.x
5.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu

cPanel before 67.9999.103 does not enforce SSL hostname verification for the support-agreement download (SEC-279).

Weakness

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Affected Software

Name Vendor Start Version End Version
Cpanel Cpanel 59.9999.58 (including) 60.0.48 (excluding)
Cpanel Cpanel 61.9999.55 (including) 62.0.30 (excluding)
Cpanel Cpanel 63.9999.74 (including) 64.0.40 (excluding)
Cpanel Cpanel 65.9999.38 (including) 66.0.23 (excluding)
Cpanel Cpanel 67.9999.64 (including) 67.9999.103 (excluding)

References