CVE-2018-18772

Published: Nov 20, 2018 Last Modified: Nov 21, 2024 EU-VD ID: EUVD-2018-10488 Aliases: GSD-2018-18772

ExploitDB:

Other exploit source:

Google Dorks:

HIGH 8,8

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: none

User Interaction: required

Scope: unchanged

Confidentiality: high

Integrity: high

Availability: high

MEDIUM 6,8

Source: [email protected]

Access Vector: network

Access Complexity: medium

Authentication: none

Confidentiality: partial

Integrity: partial

Availability: partial

Description

AI Translation Available

CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.740 allows CSRF via admin/index.php?module=send_ssh, as demonstrated by executing an arbitrary OS command.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score

0,0050

Percentile

0,7th

Updated

EPSS Score Trend (Last 90 Days)

352

Cross-Site Request Forgery (CSRF)

Stable

Abstraction: Compound Structure: Composite

Common Consequences

Security Scopes Affected:

Confidentiality Integrity Availability Non-Repudiation Access Control

Potential Impacts:

Gain Privileges Or Assume Identity Bypass Protection Mechanism Read Application Data Modify Application Data Dos: Crash, Exit, Or Restart

Applicable Platforms

Technologies: Web Based, Web Server

Likelihood of Exploit: Medium

View CWE Details

Exploit

CentOS Web Panel 0.9.8.740 - Cross-Site Request Forgery …

Cross-Site Request Forgery (CSRF)

CentOS Web Panel 0.9.8.740 - Cross-Site Request Forgery / Cross-Site Scripting

Author: InfinitumIT Published:

View Exploit Code →

Application

Webpanel by Control-Webpanel

Product Information

Vendor Control-Webpanel

Product Webpanel

Version Range Affected

To 0.9.8.740 (inclusive)

CPE Identifier

View Detailed Analysis


                  cpe:2.3:a:control-webpanel:webpanel:*:*:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

http://packetstormsecurity.com/files/150169/CentOS-Web-Pane…