Unscored severity · published Mar 11, 2004
CVE-2004-1769
The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the…
–
CVSS
34.8%
EPSS
No
On KEV
Description
The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x, allows remote attackers to execute arbitrary code via the user parameter to resetpass.
Exploitation
Is it being used?
Exploit prediction (EPSS)34.8% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
Cpanel · Cpanel
5.0; 5.3; 6.0; 6.2; 6.4; 6.4.1; +6 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-1769
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-1769
marc.info
http://marc.info/?l=bugtraq&m=107904890724201&w=2
Vendor Advisory
http://secunia.com/advisories/11111
Third Party Advisory
http://www.kb.cert.org/vuls/id/831534
Vendor Advisory
http://www.securityfocus.com/archive/1/357064/2004-03-08/2004-03-14/0
Exploit
http://www.securityfocus.com/bid/9848
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/15443
More from Cpanel
9.8
CVE-2026-41940
WebPros cPanel and WHM Authentication Bypass via Login Flow
9.8
CVE-2020-26108
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488)
9.8
CVE-2020-26105
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554)
9.8
CVE-2020-26101
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549)
9.8
CVE-2020-26100
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497)