CVE-2019-10893 Information

Description

CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to Stored/Persistent XSS for Admin Email fields on the \CWP Settings \Edit Settings\ screen. By changing the email ID to any XSS Payload and clicking on Save Changes the XSS Payload will execute.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Reference

http://forum.centos-webpanel.com/informations/ http://packetstormsecurity.com/files/152437/CentOS-Web-Panel-0.9.8.793-Free-0.9.8.753-Pro-Cross-Site-Scripting.html http://www.securityfocus.com/bid/108035 https://packetstormsecurity.com/files/152437/centoswp098email-xss.txt https://www.exploit-db.com/exploits/46669 https://www.exploit-db.com/exploits/46669/

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction Required

HIGH

Scope

REQUIRED

Confidentiality Impact

CHANGED

Integrity Impact

LOW

Availability Impact

LOW

Base Score

NONE

Base Severity

4.8