CVE-2024-34068

Katalog CVE

CVSS 6.4 · Medium EPSS 0,39%

Kerentanan Improper Access Control pada pterodactyl wings. Skor CVSS 3.1 6.4 (Medium) menurut NVD.

Deskripsi (NVD)

Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously implemented access control (GHSA-6rg3-8h8x-5xfv) that prevents accessing internal endpoints of the node hosting Wings in the pull endpoint. This would allow malicious users to potentially access resources on local networks that would otherwise be inaccessible. This issue has been addressed in version 1.11.2 and users are advised to upgrade. Users unable to upgrade may enable the `api.disable_remote_download` option as a workaround.

Rincian

Terbit di NVD

3 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control
CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pterodactyl/wings/security/advisories/GHSA-qq22-jj8x-4wwv mitigasi · patch · advisory vendor
• https://github.com/pterodactyl/wings/commit/c152e36101aba45d8868a9a0eeb890995e8934b8 patch
• https://github.com/pterodactyl/wings/security/advisories/GHSA-6rg3-8h8x-5xfv related