CVE-2019-15235

The CVE-2019-15235 entry concerns CentOS Web Panel (CWP) prior to 0.9.8.864. The vulnerability lets an attacker obtain a victim’s session file name from /home/[USERNAME]/tmp/session/sess_xxxxxx and the token value from /usr/local/cwpsrv/logs/access_log, then use these to access the victim’s passw...