CVE-2024-30257
mediumpriority · track · 24EPSS 0.004 · 32 %ileEURUUSEPSS · scored 2026-10-27
1Panel is an open source Linux server operation and maintenance management panel. The password verification in the source code uses the != symbol instead hmac.Equal. This may lead to a timing attack vulnerability. This vulnerability is fixed in 1.10.3-lts.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.9–5.9
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (6)
Products and version ranges known to be affected.
advisories (2)
Vendor and ecosystem advisories describing this.
- GHSA-6m9h-2pr2-9j8f1Panel's password verification is suspected to have a timing attack vulnerability2024-04-18ghsa · osvUS
### Summary 源码中密码校验处使用 != 符号，而不是`hmac.Equal`，这可能导致产生计时攻击漏洞，从而爆破密码。 建议使用 `hmac.Equal` 比对密码。 Translation: The source code uses the != symbol instead of hmac.Equal for password verification, which may lead to timing attack vulnerabilities that can lead to password cracking. It is recommended to use hmac. Equal to compare passwords. ### Details https://github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26 ### Impact 该产品的所有使用者。 Translation: All users of this product.
- GO-2024-27341Panel's password verification is suspected to have a timing attack vulnerability in github.com/1Panel-dev/1Panel2024-06-05vendor · osvUS
1Panel's password verification is suspected to have a timing attack vulnerability in github.com/1Panel-dev/1Panel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: github.com/1Panel-dev/1Panel before v1.10.3.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (7)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-30257/cnnvd
- https://github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26cnnvd
- https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-6m9h-2pr2-9j8fcnnvd
- https://github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26enisa_euvd
- https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-6m9h-2pr2-9j8fenisa_euvd
- https://github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26Productnvd
- https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-6m9h-2pr2-9j8fVendor Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan