PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5614 cPanel CVE debrief

CVE-2017-5614 is an open redirect vulnerability in cgiemail and cgiecho that can be abused to send users to attacker-controlled websites. The primary impact is phishing and trust abuse: a victim can be steered away from a legitimate cPanel-hosted page using the success or failure parameter. NVD rates the issue 6.1/Medium, reflecting network reachability, no privileges required, and user interaction.

Vendor
cPanel
Product
CVE-2017-5614
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-03-03
Original CVE updated
2026-05-13
Advisory published
2017-03-03
Advisory updated
2026-05-13

Who should care

cPanel administrators, hosting providers, and security teams responsible for any deployments that expose cgiemail or cgiecho to end users, especially where redirect parameters may be trusted by mail or web workflows.

Technical summary

The NVD record maps this issue to CWE-601 (open redirect). The vulnerable cPanel branches listed in the supplied record are: 11.54.0.0 through before 11.54.0.36; 55.9999.61 through before 56.0.43; 57.9999.48 through before 58.0.43; and 59.9999.58 through before 60.0.35. The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating a remotely reachable issue that depends on user interaction and can affect confidentiality and integrity through phishing-driven redirection.

Defensive priority

Medium. This is not a code-execution issue, but it can be used to increase the credibility of phishing and credential-harvesting attacks. Prioritize it for internet-facing cPanel environments and any workflow that passes users through redirect parameters.

Recommended defensive actions

  • Update cPanel to a version newer than the affected ranges listed by NVD.
  • Review any exposed cgiemail/cgiecho workflows and remove or restrict unnecessary redirect behavior.
  • Treat success/failure redirect parameters as untrusted input and allow only approved destinations.
  • If immediate patching is not possible, reduce exposure of affected endpoints and monitor for suspicious redirect patterns.
  • Update user-facing guidance so staff can recognize redirect-based phishing attempts that leverage trusted cPanel links.

Evidence notes

All vulnerability details in this debrief come from the supplied official NVD record and the references embedded in that record. The description states the open redirect behavior and the success/failure parameters. The CVSS score, vector, CWE, and affected version ranges are taken from the NVD metadata. The supplied record also lists a vendor advisory, a mailing-list disclosure reference, and a third-party advisory entry; no unsupported claims were added.

Official resources

The CVE was published on 2017-03-03T15:59:00.960Z. The supplied NVD record shows a later metadata modification on 2026-05-13T00:24:29.033Z; that later date is not the vulnerability date.