CVE-2020-10119: 
cPanel vulnerability analysis and mitigation

cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544). This vulnerability was assigned CVE-2020-10119 and was disclosed in March 2020 (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 9.8 CRITICAL with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates a critical severity vulnerability with network accessibility, low attack complexity, no privileges required, no user interaction needed, and high impacts on confidentiality, integrity, and availability (NVD).

The vulnerability allows remote code execution capabilities through the cpsrvd rsync shell, potentially giving attackers complete control over the affected system. The critical CVSS score of 9.8 indicates severe potential impacts on system confidentiality, integrity, and availability (NVD).

The vulnerability requires no special privileges or user interaction to exploit, making it highly exploitable. The attack complexity is rated as low, indicating that the vulnerability is relatively straightforward to exploit (NVD).

The vulnerability was fixed in cPanel version 84.0.20. Users should upgrade to this version or later to mitigate the risk (NVD).