Situation
A privilege escalation vulnerability exists in cPanel & WHM's database management functionality.
Affected Product Versions
| Product | Affected Versions | Patched Versions |
|---|---|---|
| cPanel/WHM | All supported versions | 11.110.0.137 11.126.0.78 11.134.0.48 11.136.0.32 138.1.6 ( WP2 ) |
Impact
An authenticated cPanel account holder with access to the MySQL/MariaDB database feature could potentially execute arbitrary database commands with full administrative privileges. Depending on the operating system and database engine configuration, this may extend to operating-system-level compromise.
Call to action
Update to the latest patched version: How do I update cPanel/WHM?
Mitigation
Servers that cannot immediately upgrade can temporarily revoke the "MySQL" feature from cPanel users. This will not disable existing databases but just prevent adding/removing. To do so, you can follow the steps here:
How to edit a feature list
Acknowledgements
WebPros thanks Vincent55 Yang for responsibly disclosing this issue.
Comments
0 comments
Article is closed for comments.