CVE-2020-29136

Published: Nov 27, 2020 Last Modified: Nov 21, 2024 EU-VD ID: EUVD-2020-21517 Aliases: GSD-2020-29136
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none
MEDIUM 4,0
Source: [email protected]
Access Vector: network
Access Complexity: low
Authentication: single
Confidentiality: partial
Integrity: none
Availability: none

Description

AI Translation Available

In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575).

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,0024
Percentile
0,5th
Updated

EPSS Score Trend (Last 90 Days)

307

Improper Restriction of Excessive Authentication Attempts

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control
Potential Impacts:
Bypass Protection Mechanism
Applicable Platforms
All platforms may be affected
View CWE Details
Application

Cpanel by Cpanel

Product Information
Vendor Cpanel
Product Cpanel
Version Range Affected
To 11.86.0.32 (exclusive)
cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Cpanel by Cpanel

Product Information
Vendor Cpanel
Product Cpanel
Version Range Affected
From 11.90.0 (inclusive)
To 11.90.0.17 (exclusive)
cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Cpanel by Cpanel

Product Information
Vendor Cpanel
Product Cpanel
Version Range Affected
From 11.92.0 (inclusive)
To 11.92.0.2 (exclusive)
cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://docs.cpanel.net/changelogs/90-change-log/
Vendor Advisory
https://docs.cpanel.net/changelogs/90-change-log/
https://news.cpanel.com/cpanel-tsr-2020-0007-full-disclosur…
Vendor Advisory
https://news.cpanel.com/cpanel-tsr-2020-0007-full-disclosure/
https://www.digitaldefense.com/news/zero-day-cpanel-and-web…
Third Party Advisory
https://www.digitaldefense.com/news/zero-day-cpanel-and-webhost-manager/
https://docs.cpanel.net/changelogs/90-change-log/
Vendor Advisory
https://docs.cpanel.net/changelogs/90-change-log/
https://news.cpanel.com/cpanel-tsr-2020-0007-full-disclosur…
Vendor Advisory
https://news.cpanel.com/cpanel-tsr-2020-0007-full-disclosure/
https://www.digitaldefense.com/news/zero-day-cpanel-and-web…
Third Party Advisory
https://www.digitaldefense.com/news/zero-day-cpanel-and-webhost-manager/