CVE-2020-29135: 
cPanel vulnerability analysis and mitigation

cPanel before version 90.0.17 contains multiple instances of URL parameter injection vulnerability (SEC-567). The vulnerability was discovered and disclosed in November 2020, affecting cPanel & WHM interfaces that create URIs to other interfaces by incorporating user-supplied data in URI query parameters (Vendor Advisory).

The vulnerability occurs because several cPanel & WHM interfaces were using URL encoding on parameters rather than URI encoding. This implementation error allows user-supplied data to be incorrectly encoded in URI query parameters. The vulnerability has been assigned a CVSS v3.1 base score of 4.1 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) (NVD).

Due to this vulnerability, a cPanel & WHM user could be misled into performing unintended actions. The vulnerability primarily affects the integrity of user interactions with the system, though the impact is limited (Vendor Advisory).

The vulnerability requires an authenticated user with low privileges and user interaction to be exploited. The attack complexity is considered low, but the attack vector is network-based (NVD).

This vulnerability has been resolved in cPanel versions 11.92.0.2, 11.90.0.17, and 11.86.0.32. Users are advised to upgrade to these or later versions to mitigate the vulnerability (Vendor Advisory).