CVE-2023-39966

Katalog CVE

CVSS 9.8 · Critical EPSS 0,83%

Kerentanan Missing Authorization pada fit2cloud 1panel. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the `api/v1/file.go` file, there is a function called `SaveContentthat,It `recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations. Version 1.5.0 contains a patch for this issue.

Rincian

Terbit di NVD

10 Agustus 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,83% peluang dieksploitasi; lebih tinggi dari 56,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-hf7j-xj3w-87g4 exploit · advisory vendor
• https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0 product · release notes