CVE-2025-34429

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-34429
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-34429.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-34429
Aliases
Downstream
Related
Published
2025-12-10T19:16:13.720Z
Modified
2026-03-23T05:01:36.584541131Z
Severity
  • 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H CVSS Calculator
Summary
[none]
Details

1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality. The port-change endpoint lacks CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a port-change request; when a victim visits it while authenticated, the browser includes valid session cookies and the request succeeds. This allows an attacker to change the port on which the 1Panel web service listens, causing loss of access on the original port and resulting in service disruption or denial of service, and may unintentionally expose the service on an attacker-chosen port.

References

Affected packages

Git / github.com/1panel-dev/1panel

Affected ranges

Type
GIT
Repo
https://github.com/1panel-dev/1panel
Events
Introduced
abd3c24562f64d3c70b939c934931d443dae0241
Last affected
7f9f4ae740b8fd80e06bb740a43a13836cc53a85
Database specific 
{
    "versions": [
        {
            "introduced": "1.10.33-lts"
        },
        {
            "last_affected": "2.0.15"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-34429.json"