CVE-2004-0490
CVE-2004-0490 is a high-severity vulnerability in Cpanel with a CVSS 2.0 base score of 7.2. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: High (CVSS 2.0 base score 7.2)
- EPSS exploit prediction: 4% (90th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Cpanel
- Published:
- Last modified:
Description
cPanel, when compiling Apache 1.3.29 and PHP with the mod_phpsuexec option, does not set the --enable-discard-path option, which causes php to use the SCRIPT_FILENAME variable to find and execute a script instead of the PATH_TRANSLATED variable, which allows local users to execute arbitrary PHP code as other users via a URL that references the attacker's script after the user's script, which executes the attacker's script with the user's privileges, a different vulnerability than CVE-2004-0529.
Frequently asked questions
- What is CVE-2004-0490?
- cPanel, when compiling Apache 1.3.29 and PHP with the mod_phpsuexec option, does not set the --enable-discard-path option, which causes php to use the SCRIPT_FILENAME variable to find and execute a script instead of the PATH_TRANSLATED variable, which allows local users to execute arbitrary PHP code as other users via a URL that references the attacker's script after the user's script, which executes the attacker's script with the user's privileges, a different vulnerability than CVE-2004-0529.
- How severe is CVE-2004-0490?
- CVE-2004-0490 has a CVSS 2.0 base score of 7.2, rated high severity.
- Is CVE-2004-0490 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 4% (90th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2004-0490?
- CVE-2004-0490 primarily affects Cpanel. In total, 13 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2004-0490?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2004-0490 published?
- CVE-2004-0490 was published on 2004-08-18 and last updated on 2026-06-16.
References
- http://bugzilla.cpanel.net/show_bug.cgi?id=283
- http://bugzilla.cpanel.net/show_bug.cgi?id=664
- http://www.a-squad.com/audit/explain10.html
- http://www.securiteam.com/tools/5TP0N15CUA.html
- http://www.securityfocus.com/archive/1/364112
- http://www.securityfocus.com/bid/10407
- https://exchange.xforce.ibmcloud.com/vulnerabilities/16239
Affected products (13)
- cpe:2.3:a:cpanel:cpanel:5.0:*:*:*:*:*:*:*
- cpe:2.3:a:cpanel:cpanel:5.3:*:*:*:*:*:*:*
- cpe:2.3:a:cpanel:cpanel:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:cpanel:cpanel:6.2:*:*:*:*:*:*:*
- cpe:2.3:a:cpanel:cpanel:6.4:*:*:*:*:*:*:*
- cpe:2.3:a:cpanel:cpanel:6.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:cpanel:cpanel:6.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:cpanel:cpanel:6.4.2_stable_48:*:*:*:*:*:*:*
- cpe:2.3:a:cpanel:cpanel:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:cpanel:cpanel:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:cpanel:cpanel:9.0:*:*:*:*:*:*:*
- cpe:2.3:a:cpanel:cpanel:9.1:*:*:*:*:*:*:*
- cpe:2.3:a:cpanel:cpanel:9.1.0_r85:*:*:*:*:*:*:*
More vulnerabilities in Cpanel
- CVE-2004-1770 — Critical (CVSS 10.0): The login page for cPanel 9.1.0, and possibly other versions, allows remote attackers to execute arbitrary code via…
- CVE-2004-1769 — Critical (CVSS 10.0): The "Allow cPanel users to reset their password via email" feature in cPanel 9.1.0 build 34 and earlier, including 8.x,…
- CVE-2003-1425 — Critical (CVSS 10.0): guestbook.cgi in cPanel 5.0 allows remote attackers to execute arbitrary commands via the template parameter.
- CVE-2026-41940 — Critical (CVSS 9.8): cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows…
- CVE-2020-26108 — Critical (CVSS 9.8): cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488).
- CVE-2020-26105 — Critical (CVSS 9.8): In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554).