PT-2022-17744 · Aapanel · Aapanel

Published 2022-03-27 · Updated 2022-04-04 · CVE-2022-26252

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions aaPanel version 6.8.21

Description The issue allows attackers to perform directory traversal, enabling them to obtain the root user's private SSH key, specifically id rsa.

Recommendations For aaPanel version 6.8.21, update to a newer version that contains a fix for this issue to prevent directory traversal attacks.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-26252

Affected Products

Aapanel

References · 5

• 🔥 https://exploit-db.com/exploits/50780 · Exploit
• https://osv.dev/vulnerability/CVE-2022-26252 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26252 · Security Note
• https://t.me/cibsecurity/39614 · Telegram Post
• https://t.me/cvenotify/28379 · Telegram Post