Incorrect Permission Assignment in Radicale CalDAV/CardDAV Server Leads to Information Disclosure

Executive Summary

This vulnerability is a permissions flaw in cPanel's CalDAV/CardDAV functionality. It allows a local user on the same server to access sensitive calendar and contact data belonging to other accounts without modifying the data or gaining root access.

Useful 0 Not Useful 0

Detection Guidance

Check cPanel/WHM version to confirm if it is affected. Use commands like 'cat /usr/local/cpanel/version' or 'whmapi1 version' to verify. Review account permissions for CalDAV/CardDAV data access. Look for unusual access patterns in logs.

Useful 0 Not Useful 0

Impact Analysis

If you are a cPanel user, a local attacker on your server could access your calendar and contact information, potentially exposing sensitive data. This could lead to privacy breaches or unauthorized data exposure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security rules for protected health information. Compliance may be compromised if sensitive data is exposed.

Useful 0 Not Useful 0

Mitigation Strategies

Update cPanel/WHM to the latest patched version (11.134.0.57 or later, 11.136.0.41 or later, 11.138.0.8 or later, WP2: 11.138.1.11 or later). Ensure permissions for CalDAV/CardDAV data are correctly assigned for all accounts.

Useful 0 Not Useful 0