CVE-2025-66508: falha de média gravidade em 1Panel-dev 1Panel
1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 0.3%
1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin's default configuration which trusts all IP addresses as proxies (TrustedProxies = 0.0.0.0/0), allowing any client to spoof the X-Forwarded-For header. Since all IP-based access controls (AllowIPs, API whitelists, localhost-only checks) rely on ClientIP(), attackers can bypass these protections by simply sending X-Forwarded-For: 127.0.0.1 or any whitelisted IP. This renders all IP-based security controls ineffective. This issue is fixed in version 2.0.14.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Produtos afetados
1Panel-dev · 1PanelCVEs relacionadas — 1Panel-dev 1Panel
No mesmo produto, das mais perigosas para as menos.
CVE-2024-39907CRITICALa sqlinjection in 1Panel EPSS 29.2%CVE-2023-37477HIGHCommand injection in firewall ip functionality in 1PanelEPSS 5.8%CVE-2024-39911CRITICAL1Panel SQL injectionEPSS 4.5%CVE-2023-36457MEDIUM1Panel vulnerable to command injection when adding container repositoriesEPSS 2.3%CVE-2023-36458MEDIUM1Panel vulnerable to ommand injection when entering the container terminalEPSS 2.3%CVE-2024-34352MEDIUMArbitrary file write vulnerability in 1Panel EPSS 1.3%