CVE-2023-29489 XSS in cpanel at [www.███] - Securado, Oman

How it was found

Description: There is a cross-site scripting vulnerability found on cpanel application hosted on the website. Cpanel is not updated because auto update feature is disabled.

Impact

An attacker can steal cookies or hijack browser session.

System Host(s)

www.██████

Affected Product(s) and Version(s)

CVE Numbers

Steps to Reproduce

1. Go to http://www.████/cpanelwebcall/%3Cimg%20src=x%20onerror=%22prompt(1)%22%3Eaaaaaaaaaaaa
2. You will see XSS popup message

Suggested Mitigation/Remediation Actions

Enable autoupdate feature and update cpanel