PT-2023-3483 · 1Panel · 1Panel

Wanghe-Fit2Cloud · Publicado 2023-06-21 · Atualizado 2024-08-20 · CVE-2023-36458

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions 1Panel versions prior to 1.3.6

Description The issue is related to command injection when entering the container terminal in 1Panel, an open source Linux server operation and maintenance management panel. An authenticated attacker can craft malicious payloads to achieve this. The vulnerability allows a remote attacker to execute arbitrary commands.

Recommendations For versions prior to 1.3.6, upgrade to version 1.3.6 to fix the vulnerability. As a temporary workaround, consider restricting access to the container terminal until the upgrade is applied.

Exploit

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2023-03678

CVE-2023-36458

GHSA-7X2C-FGX6-XF9H

GO-2023-1888

Produtos afetados

1Panel

Referências · 12

• 🔥 https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-7x2c-fgx6-xf9h · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/36xxx/CVE-2023-36458.json · Exploit
• https://github.com/1Panel-dev/1Panel · Nota
• https://github.com/1Panel-dev/1Panel/blob/dev/README_EN.md · Nota
• https://github.com/1Panel-dev/1Panel/releases/tag/v1.3.6 · Nota
• https://vuldb.com/ru/?id.233027 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-36458 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-36458 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-7x2c-fgx6-xf9h · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-03678 · Nota de Segurança
• https://t.me/cibsecurity/66016 · Publicação no Telegram
• https://osv.dev/vulnerability/GO-2023-1888 · Aviso do Fabricante