QSearchQSearch

CVE-2021-38590

5.5 MEDIUM

In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584)

Published: 2021-08-11 · Last updated: 2026-06-17

Severity and scoring

CVSS
5.5 MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CWE
CWE-732

Affected products

VendorProduct
cpanelcpanel

Description

In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584).

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2021-38589 — In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588) (8.1 HIGH)
  • CVE-2021-38588 — In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587) (8.1 HIGH)
  • CVE-2021-38587 — In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586) (7.5 HIGH)
  • CVE-2021-38586 — In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589) (4.4 MEDIUM)
  • CVE-2021-38585 — The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585) (7.2 HIGH)

Same CWE

  • CVE-2026-53856 — OpenClaw before 2026.4.24 contains an insecure file permissions vulnerability in config recovery that restores OpenClaw.json with overly ... (5.5 MEDIUM)
  • CVE-2026-0271 — A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma Access Agent app on Linux devices enables a local user to exec...
  • CVE-2026-50570 — Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes (8.5 HIGH)
  • CVE-2026-26422 — clash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, leading to local privilege escalation (8.4 HIGH)
  • CVE-2026-50590 — In Mimecast Incydr before 2.6.0, arbitrary file access can occur (4.5 MEDIUM)