CVE-2023-39964CWE-22

1Panel O&M management panel has a background arbitrary file reading vulnerability

High · published August 10, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
61.6
In the wild
Unconfirmed
What it is

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, arbitrary file reads allow an attacker to read arbitrary important configuration files on the server. In the `api/v1/file.go` file, there is a function called `LoadFromFile`, which directly reads the file by obtaining the requested path `parameter[path]`. The request parameters are not filtered, resulting in a background arbitrary file reading vulnerability. Version 1.5.0 has a patch for this issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00972 · 61.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2023-08-10T17:39Z
EPSS history
Timeline
  • 10 AUG 17:39Z
    1Panel O&M management panel has a background arbitrary file reading vulnerability
    cvelistv5