Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2016-10818: cPanel logs may be readable by unauthorized users

CVE-2016-10818 · published 7 years ago

Summary

cPanel versions earlier than 57.9999.54 set the file permissions for certain log files, such as those for DNS administration and spam filtering, too loosely. This could allow anyone with access to the server to view these logs and potentially gather sensitive information. Update cPanel to the latest release or apply the vendor’s recommended fix to correct the permissions.

What to do

Update cpanel cpanel to version 56.0.15 or later.

Affected software

Vendor	Product	Affected versions
cpanel	cpanel	< 56.0.15 `cpe:2.3:a:cpanel:cpanel::::::::`

Original advisory text

cPanel before 57.9999.54 incorrectly sets log-file permissions in dnsadmin-startup and spamd-startup (SEC-124).

References

https://news.cpanel.com/cpanel-tsr-2016-0003-full-disclosure/ Vendor Advisory
https://documentation.cpanel.net/display/CL/58+Change+Log Product Release Notes

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-275Permission Issues

Timeline

Published1 Aug 2019

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2016-10818 · NVD

Track software like this

Free during beta