CVE-2023-39965

2023-08-1018:15:11

CWE-863

[email protected]

web.nvd.nist.gov

2466

1panel

linux

server

management

api

security

vulnerability

nvd

cve-2023-39965

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

4.5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

JSON

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. Attackers can freely download the file content on the target system. This may cause a large amount of information leakage. Version 1.5.0 has a patch for this issue.

Affected configurations

Vulners

NVD

Node

1panel-dev1panelMatch1.4.3

CPENameOperatorVersion
fit2cloud:1panelfit2cloud 1paneleq1.4.3

CPE	Name	Operator	Version
fit2cloud:1panel	fit2cloud 1panel	eq	1.4.3

CNA Affected

[
  {
    "vendor": "1Panel-dev",
    "product": "1Panel",
    "versions": [
      {
        "version": "= 1.4.3",
        "status": "affected"
      }
    ]
  }
]