CVE-2023-39966: falha de alta gravidade em 1Panel-dev 1Panel
1Panel arbitrary file write vulnerability exists in the background
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.8%
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the `api/v1/file.go` file, there is a function called `SaveContentthat,It `recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations. Version 1.5.0 contains a patch for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Produtos afetados
1Panel-dev · 1PanelCVEs relacionadas — 1Panel-dev 1Panel
No mesmo produto, das mais perigosas para as menos.
CVE-2024-39907CRITICALa sqlinjection in 1Panel EPSS 29.2%CVE-2023-37477HIGHCommand injection in firewall ip functionality in 1PanelEPSS 5.8%CVE-2024-39911CRITICAL1Panel SQL injectionEPSS 4.5%CVE-2023-36457MEDIUM1Panel vulnerable to command injection when adding container repositoriesEPSS 2.3%CVE-2023-36458MEDIUM1Panel vulnerable to ommand injection when entering the container terminalEPSS 2.3%CVE-2024-34352MEDIUMArbitrary file write vulnerability in 1Panel EPSS 1.3%