LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.
Bu açık CISA tarafından aktif istismar edildiği doğrulanmış açıklar katalogunda yer alıyor. Teorik bir risk değil — sahada kullanılıyor.
LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
HTTP Smuggling in cPanel allows potential leak of credentials.
Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.