CVE-2023-39966CWE-862

1Panel arbitrary file write vulnerability exists in the background

High · published August 10, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
57.2
In the wild
Unconfirmed
What it is

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the `api/v1/file.go` file, there is a function called `SaveContentthat,It `recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations. Version 1.5.0 contains a patch for this issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00834 · 57.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2023-08-10T17:46Z
EPSS history
Timeline
  • 10 AUG 17:46Z
    1Panel arbitrary file write vulnerability exists in the background
    cvelistv5