Medium severity · published Oct 18, 2004
CVE-2004-1603
cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file when…
5.5
CVSS
1.6%
EPSS
No
On KEV
Description
cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
Cpanel · Cpanel
9.4.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2004-1603
CVE.org
https://www.cve.org/CVERecord?id=CVE-2004-1603
Mailing List
http://marc.info/?l=bugtraq&m=109811572123753&w=2
Mailing List
http://marc.info/?l=bugtraq&m=109811654104208&w=2
Broken Link
http://secunia.com/advisories/12865
Broken Link
http://www.securityfocus.com/bid/11449
Broken Link
http://www.securityfocus.com/bid/11455
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/17779
More from Cpanel
9.8
CVE-2026-41940
WebPros cPanel and WHM Authentication Bypass via Login Flow
9.8
CVE-2020-26108
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488)
9.8
CVE-2020-26105
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554)
9.8
CVE-2020-26101
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549)
9.8
CVE-2020-26100
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497)