CVE-2020-26111: 
cPanel vulnerability analysis and mitigation

cPanel before version 90.0.10 contains a self-XSS (Cross-Site Scripting) vulnerability in the WHM Edit DNS Zone interface, identified as CVE-2020-26111 and tracked internally as SEC-566. The vulnerability was disclosed on September 25, 2020 (NVD).

The vulnerability is classified as a self-XSS issue, which allows an attacker to execute malicious scripts in their own browser context through the WHM Edit DNS Zone interface. The severity is rated as MEDIUM with a CVSS v3.1 Base Score of 6.1 (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and CVSS v2.0 Base Score of 4.3 (Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N) (NVD).

The vulnerability allows for client-side code execution within the user's browser context when interacting with the WHM Edit DNS Zone interface. This could potentially lead to unauthorized access to user data or manipulation of the interface content within the user's session (NVD).

The vulnerability requires user interaction and can be triggered through the WHM Edit DNS Zone interface. It affects all versions of cPanel prior to 90.0.10 (NVD).

The vulnerability has been fixed in cPanel version 90.0.10. Users are advised to upgrade to this version or later to mitigate the risk (cPanel Changelog).