Medium severity · published Mar 3, 2017
CVE-2017-5614
Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the (1)…
6.1
CVSS
1.2%
EPSS
No
On KEV
Description
Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the (1) success or (2) failure parameter.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
Cpanel · Cpanel
11.54.0.0 before 11.54.0.36; 55.9999.61 before 56.0.43; 57.9999.48 before 58.0.43; 59.9999.58 before 60.0.35 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-5614
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-5614
Mailing List
http://www.openwall.com/lists/oss-security/2017/01/28/8
Third Party Advisory
http://www.securityfocus.com/bid/95870
Vendor Advisory
https://news.cpanel.com/tsr-2017-0001-full-disclosure/
More from Cpanel
9.8
CVE-2026-41940
WebPros cPanel and WHM Authentication Bypass via Login Flow
9.8
CVE-2020-26108
cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488)
9.8
CVE-2020-26105
In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554)
9.8
CVE-2020-26101
In cPanel before 88.0.3, insecure RNDC credentials are used for BIND on a templated VM (SEC-549)
9.8
CVE-2020-26100
chsh in cPanel before 88.0.3 allows a Jailshell escape (SEC-497)