Vulnerability · Published Feb 5, 2024 · Assigned by GitHub_M
CVE-2024-247681Panel set-cookie is missing the Secure keyword
Medium 6.5
In plain English
A medium-severity security flaw in 1Panel from 1Panel-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 76.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue has been patched in version 1.9.6.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/1Panel-dev/1Panel | 1.9.6 | GHSA-9xfw-jjq2-7v8h |
| Go | github.com/1Panel-dev/1Panel | 1.9.6 | GO-2024-2531 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| 1Panel-dev | 1Panel | <= 1.9.5 |
Weakness: CWE-315 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
References
- https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-9xfw-jjq2-7v8h x_refsource_CONFIRM
- https://github.com/1Panel-dev/1Panel/pull/3817 x_refsource_MISC
- https://github.com/1Panel-dev/1Panel/commit/1169648162c4b9b48e0b4aa508f9dea4d6bc50d5 x_refsource_MISC