PT-2023-3996 · Unknown · Cloudpanel

Etharus + 5 · Publicado 2023-06-01 · Atualizado 2024-12-09 · CVE-2023-35885

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CloudPanel versions 2.0.0 through 2.3.0 CloudPanel version 2.3.0

Description The issue is related to insufficient access control in the File Manager component of CloudPanel, specifically when handling clp-fm cookie files without verifying their authenticity and integrity. This can allow a remote attacker to gain unauthorized access to protected information and elevate their privileges.

Recommendations For CloudPanel versions 2.0.0 through 2.3.0, update to version 2.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the File Manager component until a patch is applied.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

CWE-565

Identificadores relacionados

BDU:2023-04294

CVE-2023-35885

Produtos afetados

Cloudpanel

Referências · 16

• 🔥 https://github.com/datackmy/FallingSkies-CVE-2023-35885 · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2023-35885 · Exploit
• 🔥 https://datack.my/fallingskies-cloudpanel-0-day · Exploit
• https://t.me/pentestingnews/37884 · Publicação no Telegram
• https://twitter.com/ET_Labs/status/1838692590792905217 · Publicação no Twitter
• https://t.me/cvenotify/54793 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-35885 · Nota de Segurança
• https://t.me/freedomf0x/20192 · Publicação no Telegram
• https://twitter.com/rst_cloud/status/1837592736188272761 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2023-04294 · Nota de Segurança
• https://vuldb.com/ru/?id.232047 · Nota
• https://t.me/proxy_bar/1648 · Publicação no Telegram
• https://cloudpanel.io/docs/v2/changelog · Nota
• https://t.me/cvenotify/103603 · Publicação no Telegram
• https://cloudpanel.io/docs/v2/frontend-area/file-manager · Nota