Unscored severity · published May 12, 2008
CVE-2008-2070
The WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allows remote attackers to bypass XSS protection and inject arbitrary script or HTML via…
–
CVSS
2.2%
EPSS
No
On KEV
Description
The WHM interface 11.15.0 for cPanel 11.18 before 11.18.4 and 11.22 before 11.22.3 allows remote attackers to bypass XSS protection and inject arbitrary script or HTML via repeated, improperly-ordered "<" and ">" characters in the (1) issue parameter to scripts2/knowlegebase, (2) user parameter to scripts2/changeip, (3) search parameter to scripts2/listaccts, and other unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 82% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
Cpanel · Cpanel
11.18; 11.18.1; 11.18.2; 11.18.3; 11.22; 11.22.1; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-2070
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-2070
changelog.cpanel.net
http://changelog.cpanel.net/?revision=0%3Btree=%3Btreeview=%3Bshow=html%3Bpp=25%3Bte=1314%3Bpg=2
lists.grok.org.uk
http://lists.grok.org.uk/pipermail/full-disclosure/2008-May/062197.html
secunia.com
http://secunia.com/advisories/30166
securityreason.com
http://securityreason.com/securityalert/3866
www.securityfocus.com
http://www.securityfocus.com/archive/1/491864/100/0/threaded
Exploit
http://www.securityfocus.com/bid/29125
More from Cpanel
9.8
CVE-2026-41940
WebPros cPanel and WHM Authentication Bypass via Login Flow
9.8
CVE-2020-26108
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488)
9.8
CVE-2020-26105
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554)
9.8
CVE-2020-26101
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549)
9.8
CVE-2020-26100
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497)