CVE-2020-26110: 
cPanel vulnerability analysis and mitigation

cPanel before version 88.0.13 contains a self-XSS (Cross-Site Scripting) vulnerability in the DNS Zone Manager DNSSEC interfaces, identified as SEC-564. This vulnerability was disclosed on September 25, 2020 (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.1 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Under CVSS v2.0, it received a Base Score of 4.3 (MEDIUM) with the vector (AV:N/AC:M/Au:N/C:N/I:P/A:N). The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

The vulnerability allows an attacker to execute self-XSS attacks through the DNS Zone Manager DNSSEC interfaces. This could potentially lead to unauthorized access to sensitive information and manipulation of user data within the affected interface (NVD).

The vulnerability requires user interaction to be exploited, as indicated by the CVSS vector's UI:R component. The attack can be initiated remotely (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N) (NVD).

The vulnerability has been fixed in cPanel version 88.0.13. Users are advised to upgrade to this version or later to mitigate the risk (Vendor Advisory).