CVE-2023-39966
criticalPriorität · verfolgen · 39OT-Risiko · erhöhtEPSS 0.008 · 57. PerzentilEUUSEPSS · bewertet 2026-10-27
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the `api/v1/file.go` file, there is a function called `SaveContentthat,It `recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations. Version 1.5.0 contains a patch for this issue.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.5–9.8
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (3)
Betroffene Produkte und Versionsbereiche.
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- GHSA-hf7j-xj3w-87g41Panel arbitrary file write vulnerability2023-08-10ghsa · osvUS
# Summary An arbitrary file write vulnerability could lead to direct control of the server # Details ## Arbitrary file creation In the api/v1/file.go file, there is a function called SaveContentthat,It recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations.It looks like this: - Vulnerable Code  # PoC - We can write the SSH public key into the /etc/.root/authorized_keys configuration file on the server.  - The server was successfully written to the public key  - Successfully connected to the target server using an SSH private key.   As a result, the server is directly controlled, causing serious **harm** # Impact 1Panel v1.4.3
- GO-2023-20061Panel arbitrary file write vulnerability in github.com/1Panel-dev/1Panel2024-08-21vendor · osvUS
1Panel arbitrary file write vulnerability in github.com/1Panel-dev/1Panel
auch bekannt als (5)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (7)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2023-39966/cnnvd
- https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0cnnvd
- https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-hf7j-xj3w-87g4cnnvd
- https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0enisa_euvd
- https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-hf7j-xj3w-87g4enisa_euvd
- https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0ProductRelease Notesnvd
- https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-hf7j-xj3w-87g4ExploitVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan