PT-2025-2971 · Openpanel · Openpanel

Published 2025-01-31 · Updated 2025-05-23 · CVE-2024-53584

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenPanel version 0.3.4

Description A command injection vulnerability was discovered in OpenPanel, allowing an attacker to inject system commands via the timezone parameter. This issue can potentially be exploited to execute arbitrary system commands.

Recommendations For OpenPanel version 0.3.4, as a temporary workaround, consider restricting access to the timezone parameter until a patch is available. Avoid using the timezone parameter in affected configurations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-53584

Affected Products

Openpanel

References · 10

• 🔥 https://exploit-db.com/exploits/52197 · Exploit
• 🔥 https://packetstorm.news/files/id/188915 · Exploit
• https://osv.dev/vulnerability/CVE-2024-53584 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-53584 · Security Note
• https://openpanel.com/docs/changelog/0.3.5/#%EF%B8%8F-security-fixes · Note
• https://twitter.com/ExCraft_labs/status/1909951269520764946 · Twitter Post
• https://twitter.com/CVEnew/status/1885370170853777660 · Twitter Post
• https://t.me/cvenotify/123480 · Telegram Post
• https://t.me/cvedetector/16961 · Telegram Post
• https://twitter.com/syedaquib77/status/1911832128226045967 · Twitter Post