PT-2023-3996 · Unknown · Cloudpanel

Etharus + 5 · Published 2023-06-01 · Updated 2024-12-09 · CVE-2023-35885

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CloudPanel versions 2.0.0 through 2.3.0 CloudPanel version 2.3.0

Description The issue is related to insufficient access control in the File Manager component of CloudPanel, specifically when handling clp-fm cookie files without verifying their authenticity and integrity. This can allow a remote attacker to gain unauthorized access to protected information and elevate their privileges.

Recommendations For CloudPanel versions 2.0.0 through 2.3.0, update to version 2.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the File Manager component until a patch is applied.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-565

Related Identifiers

BDU:2023-04294

CVE-2023-35885

Affected Products

Cloudpanel

References · 16

• 🔥 https://github.com/datackmy/FallingSkies-CVE-2023-35885 · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2023-35885 · Exploit
• 🔥 https://datack.my/fallingskies-cloudpanel-0-day · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-35885 · Security Note
• https://bdu.fstec.ru/vul/2023-04294 · Security Note
• https://osv.dev/vulnerability/CVE-2023-35885 · Vendor Advisory
• https://t.me/pentestingnews/37884 · Telegram Post
• https://twitter.com/ET_Labs/status/1838692590792905217 · Twitter Post
• https://t.me/cvenotify/54793 · Telegram Post
• https://t.me/freedomf0x/20192 · Telegram Post
• https://twitter.com/rst_cloud/status/1837592736188272761 · Twitter Post
• https://vuldb.com/ru/?id.232047 · Note
• https://t.me/proxy_bar/1648 · Telegram Post
• https://cloudpanel.io/docs/v2/changelog · Note
• https://t.me/cvenotify/103603 · Telegram Post