Vulnerability · Published Mar 6, 2024 · Assigned by GitHub_M
CVE-2024-272881Panel open source panel project has an unauthorized vulnerability.
Medium 6.3
In plain English
A medium-severity incorrect authorization in 1Panel from 1Panel-dev. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.5%top 59.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access to the console page. The vulnerability has been fixed in v1.10.1-lts. There are no known workarounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/1Panel-dev/1Panel | 1.10.1-lts | GHSA-26w3-q4j8-4xjp |
| Go | github.com/1Panel-dev/1Panel | 1.10.1-lts | GO-2024-2613 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| 1Panel-dev | 1Panel | < 1.10.1-lts |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
References
- https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-26w3-q4j8-4xjp x_refsource_CONFIRM
- https://github.com/1Panel-dev/1Panel/releases/tag/v1.10.1-lts x_refsource_MISC