Vulnerabilities > CVE-2019-14246 - Authorization Bypass Through User-Controlled Key vulnerability in Centos-Webpanel Centos web Panel 0.9.8.851

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
centos-webpanel
CWE-639
NVD
Published: 2019-08-21
Updated: 2024-11-21

Summary

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.851, an insecure object reference allows an attacker to discover phpMyAdmin passwords (of any user in /etc/passwd) via an attacker account.

Vulnerable Configurations

Part Description Count
Application
Centos-Webpanel
1

Common Weakness Enumeration (CWE)

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/154156/cwp098851-resetpassword.txt
idPACKETSTORM:154156
last seen2019-09-05
published2019-08-20
reporterPongtorn Angsuchotmetee
sourcehttps://packetstormsecurity.com/files/154156/CentOS-WebPanel.com-Control-Web-Panel-CWP-0.9.8.851-phpMyAdmin-Password-Change.html
titleCentOS-WebPanel.com Control Web Panel (CWP) 0.9.8.851 phpMyAdmin Password Change

References