CVE-2020-26113: 
cPanel vulnerability analysis and mitigation

cPanel before version 90.0.10 was found to contain a self Cross-Site Scripting (XSS) vulnerability in the WHM Manage API Tokens interfaces, identified as CVE-2020-26113 (SEC-569). The vulnerability was disclosed on September 25, 2020 (NVD).

The vulnerability is classified as a Cross-Site Scripting (CWE-79) issue, specifically involving improper neutralization of input during web page generation. The CVSS v3.1 base score is 6.1 (Medium), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability is network exploitable, requires low attack complexity, needs no privileges, but does require user interaction (NVD).

If exploited, this self XSS vulnerability could allow an attacker to execute arbitrary web scripts or HTML in the context of the WHM Manage API Tokens interface. This could potentially lead to the disclosure of sensitive information or manipulation of the interface content (NVD).

The vulnerability requires user interaction to be exploited, as indicated by the CVSS metrics. The attack vector is network-accessible, making it possible to exploit remotely, though no known exploits in the wild have been publicly reported (NVD).

The vulnerability was addressed in cPanel version 90.0.10. Users are advised to upgrade to this version or later to mitigate the risk. No alternative workarounds have been publicly documented (cPanel Changelog).