CVE-2004-1603

MediumCVSS 5.5/10Last modified Jun 16, 2026

Description

cPanel 9.4.1-RELEASE-64 follows hard links, which allows local users to (1) read arbitrary files via the backup feature or (2) chown arbitrary files via the .htaccess file when Front Page extensions are enabled or disabled.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-59

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Oct 18, 2004
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2004

CVE-2004-16045.0cPanel 9.9.1-RELEASE-3 allows remote authenticated users to chmod arbitrary files via a symlink attack on the _private directory, which is cCVE-2004-16057.5SalesLogix 6.1 allows remote attackers to bypass authentication by modifying the slxweb cookie to set user=Admin, teams=ADMIN!, and usertypeCVE-2004-16066.4slxweb.dll in SalesLogix 6.1 allows remote attackers to cause a denial service (application crash) via an invalid HTTP request, which might CVE-2004-16075.0slxweb.dll in SalesLogix 6.1 allows remote attackers to obtain sensitive information via a (1) Library or (2) Attachment request with an invCVE-2004-16087.5SQL injection vulnerability in SalesLogix 6.1 allows remote attackers to execute arbitrary SQL statements via the id parameter in a view opeCVE-2004-16095.0SalesLogix 6.1 includes usernames, passwords, and other sensitive information in the headers of an HTTP response, which could allow remote aCVE-2004-16107.5SalesLogix 6.1 uses client-specified pathnames for writing certain files, which might allow remote authenticated users to create arbitrary fCVE-2004-16115.1SalesLogix 6.1 does not verify if a user is authenticated before performing sensitive operations, which could allow remote attackers to (1) CVE-2004-16125.0Directory traversal vulnerability in SalesLogix 6.1 allows remote attackers to upload arbitrary files via a .. (dot dot) in a ProcessQueueFiCVE-2004-16135.0Mozilla allows remote attackers to cause a denial of service (application crash from null dereference or infinite loop) via a web page that CVE-2004-16145.0Mozilla allows remote attackers to cause a denial of service (application crash from invalid memory access) via an "unusual combination of vCVE-2004-16152.6Opera allows remote attackers to cause a denial of service (invalid memory reference and application crash) via a web page or HTML email tha
CVE-2004-1603: Medium severity, CVSS 5.5 | Vulnix