PT-2024-21796 · 1Panel · 1Panel

Wanghe-Fit2Cloud · Published 2024-03-06 · Updated 2025-02-11 · CVE-2024-27288

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions 1Panel versions prior to 1.10.1-lts

Description 1Panel is an open source Linux server operation and maintenance management panel. Users can obtain unauthorized access to the console page by intercepting with Burp. The vulnerability allows access to the console page, although no data is returned and no modification operations can be performed.

Recommendations To resolve the issue, upgrade to version 1.10.1-lts or later. As a temporary workaround, consider restricting access to the console page until the upgrade is applied.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-27288

GHSA-26W3-Q4J8-4XJP

GO-2024-2613

Affected Products

1Panel

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27288.json · Exploit
• https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-26w3-q4j8-4xjp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27288 · Security Note
• https://osv.dev/vulnerability/GHSA-26w3-q4j8-4xjp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-27288 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2613 · Vendor Advisory
• https://github.com/1Panel-dev/1Panel · Note
• https://github.com/1Panel-dev/1Panel/releases/tag/v1.10.1-lts · Note
• https://github.com/1Panel-dev/1Panel/pull/4014 · Note
• https://t.me/cvenotify/73166 · Telegram Post
• https://t.me/cvenotify/110878 · Telegram Post
• https://twitter.com/momika233/status/1766134622654787679 · Twitter Post