CVE Feed

    Dashboard / CVE / CVE-2019-13605

    CVE-2019-13605

    In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveraging the knowledge of a valid username. The attacker must defeat an encoding that is not equivalent to base64, and thus this is different from CVE-2019-13360.

    Published:Jul 16, 2019
    Last Modified:Nov 21, 2024
    EPS:Jul 16, 2019
    EPSS Score:0.04853
    CVSS Score:8.8

    Affected Products

    Vendor
    Control-webpanel
    Product
    Webpanel

    Exploits

    http://packetstormsecurity.com/files/153665/CentOS-Control-Web-Panel-0.9.8.836-Authentication-Bypass.htmlhttps://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13605.mdhttps://www.exploit-db.com/exploits/47123http://packetstormsecurity.com/files/153665/CentOS-Control-Web-Panel-0.9.8.836-Authentication-Bypass.htmlhttps://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13605.mdhttps://www.exploit-db.com/exploits/47123https://www.exploit-db.com/exploits/47123

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-48703 (CVSS 9) — CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution…
    CVE-2023-42123 (CVSS 8.8) — Control Web Panel mysql_manager Command Injection Remote Code Execution Vulnerability. This vulnerability allo…
    CVE-2023-42122 (CVSS 7.8) — Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability. This vulnerability allow…
    CVE-2023-42121 (CVSS 9.8) — Control Web Panel Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote…
    CVE-2023-42120 (CVSS 8.8) — Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability. This vulnerability al…
    CVE-2022-44877 (CVSS 9.8) — login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers…
    CVE-2021-45466 (CVSS 9.8) — In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to …
    CVE-2021-45467 (CVSS 9.8) — In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 …
    CVE-2022-25048 (CVSS 8.8) — Command injection vulnerability in CWP v0.9.8.1126 that allows normal users to run commands as the root user.…
    CVE-2022-25047 (CVSS 5.9) — The password reset token in CWP v0.9.8.1126 is generated using known or predictable values.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High