CVE-2023-39964: high-severity vulnerability in 1Panel-dev 1Panel
1Panel O&M management panel has a background arbitrary file reading vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
43Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck.
ssvc Actcvss 7.5epss 1.0%
from disclosure to weapon
Published on NVDAug 10
VulnCheck+970d
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, arbitrary file reads allow an attacker to read arbitrary important configuration files on the server. In the `api/v1/file.go` file, there is a function called `LoadFromFile`, which directly reads the file by obtaining the requested path `parameter[path]`. The request parameters are not filtered, resulting in a background arbitrary file reading vulnerability. Version 1.5.0 has a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
1Panel-dev · 1PanelRelated CVEs — 1Panel-dev 1Panel
In the same product, most dangerous first.
CVE-2024-39907CRITICALa sqlinjection in 1Panel EPSS 29.2%CVE-2023-37477HIGHCommand injection in firewall ip functionality in 1PanelEPSS 5.8%CVE-2024-39911CRITICAL1Panel SQL injectionEPSS 4.5%CVE-2023-36457MEDIUM1Panel vulnerable to command injection when adding container repositoriesEPSS 2.3%CVE-2023-36458MEDIUM1Panel vulnerable to ommand injection when entering the container terminalEPSS 2.3%CVE-2024-34352MEDIUMArbitrary file write vulnerability in 1Panel EPSS 1.3%