CVE-2024-39907

critical · 9.8

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have been resolved in version 1.10.12-tls. Users are advised to upgrade. There are no known workarounds for these issues.

9.8

CVSS

29.2%

EPSS (exploit prob.)

98th

EPSS percentile

2024-07-18

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
fit2cloud	1panel	>= 1.10.9-lts, < 1.10.12-lts

Check a specific version with /api/v1/cve/match.

References

https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-5grx-v727-qmq6
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-5grx-v727-qmq6

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-39907