CVE-2023-39966

Source
https://nvd.nist.gov/vuln/detail/CVE-2023-39966
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-39966.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-39966
Aliases
Published
2023-08-10T18:15:11Z
Modified
2024-08-21T14:41:55.431289Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the api/v1/file.go file, there is a function called SaveContentthat,Itrecieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations. Version 1.5.0 contains a patch for this issue.

References

Affected packages

Git / github.com/1panel-dev/1panel

Affected ranges

Type
GIT
Repo
https://github.com/1panel-dev/1panel
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected

Affected versions

v1.*

v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.3.0
v1.3.1
v1.3.2
v1.3.3
v1.4.0
v1.4.1
v1.4.2
v1.4.3