PT-2024-20546 · 1Panel · 1Panel

Wanghe-Fit2Cloud · Published 2024-02-05 · Updated 2024-06-28 · CVE-2024-24768

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions 1Panel versions prior to 1.9.6

Description The HTTPS cookie that comes with the 1Panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue affects everyone who has configured the panel for HTTPS.

Recommendations For versions prior to 1.9.6, update to version 1.9.6 to resolve the issue. As a temporary workaround, consider configuring HTTPS directly for the panel to minimize the risk of exploitation. Restrict access to the panel when using HTTP to prevent the cookie from being sent in plain text.

Exploit

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-315

CWE-311

Related Identifiers

CVE-2024-24768

GHSA-9XFW-JJQ2-7V8H

GO-2024-2531

Affected Products

1Panel

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24768.json · Exploit
• https://github.com/1Panel-dev/1Panel/pull/3817 · Patch
• https://github.com/1Panel-dev/1Panel/commit/1169648162c4b9b48e0b4aa508f9dea4d6bc50d5 · Patch
• https://osv.dev/vulnerability/CVE-2024-24768 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24768 · Security Note
• https://osv.dev/vulnerability/GHSA-9xfw-jjq2-7v8h · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2531 · Vendor Advisory
• https://github.com/1Panel-dev/1Panel · Note
• https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-9xfw-jjq2-7v8h · Note
• https://t.me/cvenotify/71161 · Telegram Post
• https://t.me/cvenotify/70062 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1754560100604289504 · Twitter Post
• https://twitter.com/CVEnew/status/1754524053757378890 · Twitter Post