CVE-2003-1426
Severity CVSS v4.0:
Pending analysis
Type:
CWE-16
Configuration Errors
Publication date:
31/12/2003
Last modified:
03/04/2025
Description
Openwebmail in cPanel 5.0, when run using suid Perl, adds the directory in the SCRIPT_FILENAME environment variable to Perl's @INC include array, which allows local users to execute arbitrary code by modifying SCRIPT_FILENAME to reference a directory containing a malicious openwebmail-shared.pl executable.
Impact
Base Score 2.0
3.30
Severity 2.0
LOW
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:cpanel:cpanel:5.0:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0087.html
- http://www.securityfocus.com/bid/6885
- https://exchange.xforce.ibmcloud.com/vulnerabilities/11357
- http://archives.neohapsis.com/archives/vulnwatch/2003-q1/0087.html
- http://www.securityfocus.com/bid/6885
- https://exchange.xforce.ibmcloud.com/vulnerabilities/11357