CVE-2019-13359

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp directory, and use it to become the root user.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/153666/CentOS-Control-Web-Panel-0.9.8.836-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13359.mdExploit, Third Party Advisory
http://packetstormsecurity.com/files/153666/CentOS-Control-Web-Panel-0.9.8.836-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/i3umi3iei3ii/CentOS-Control-Web-Panel-CVE/blob/master/CVE-2019-13359.mdExploit, Third Party Advisory

Timeline

Published: Jul 16, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-13367.8An elevation of privilege vulnerability exists in the Microsoft Windows Update Client when it does not properly handle privileges, aka 'Micr CVE-2019-133609.8In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging k CVE-2019-133616.5Smanos W100 1.0.0 devices have Insecure Permissions, exploitable by an attacker on the same Wi-Fi network.CVE-2019-133627.8Codedoc v3.2 has a stack-based buffer overflow in add_variable in codedoc.c, related to codedoc_strlcpy.CVE-2019-133639.6admin.php?page=notification_by_mail in Piwigo 2.9.5 has XSS via the nbm_send_html_mail, nbm_send_mail_as, nbm_se CVE-2019-133649.6admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number, billing_name, company, or billing_address parameter. CVE-2019-13375.5An information disclosure vulnerability exists when Windows Update Client fails to properly handle objects in memory, aka 'Windows Update Cl CVE-2019-133708.8index.php/admin/permissions in Ignited CMS through 2017-02-19 allows CSRF to add an administrator.CVE-2019-133729.8/web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute arb CVE-2019-133739.8An issue was discovered in the D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6. Input does not get validated and arbitrary SQL CVE-2019-133746.1A cross-site scripting (XSS) vulnerability in resource view in PayAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100 CVE-2019-133759.8A SQL Injection was discovered in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 in PayAction.class.php with the index.php/Pay