CVE CVE

CVE-2024-51567

CISA Known Exploited Vulnerability (KEV)

CyberPanel Incorrect Default Permissions Vulnerability

November 7, 2024

November 28, 2024

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.

Weakness Enumeration

CWE-ID CWE Name

CWE-276
Incorrect Default Permissions

CWE-306
Missing Authentication for Critical Function

Known Affected Software Configurations


cpe:2.3:a:cyberpanel:cyberpanel:-:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:1.7.2:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:1.7.3:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:1.7.4:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:1.7.7:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:1.8.3:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:1.8.5:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:1.8.7:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:1.8.8:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:1.8.9:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:1.9.0:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:1.9.1:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:1.9.2:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:1.9.3:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:1.9.4:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:2.0.0:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:2.0.1:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:2.0.2:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:2.0.3:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:2.1.1:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:2.1.2:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:2.3.4:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:2.3.5:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:2.3.6:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:2.3.7:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:1.8.4:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:1.8.2:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:1.8.1:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:1.7.6:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:1.7.5:*:*:*:*:*:*:*

cpe:2.3:a:cyberpanel:cyberpanel:1.7.1:*:*:*:*:*:*:*

Details

Source:
NVD
Published:
Updated:

Risk information

CVSS v3

Base score:
9.8
Severity:

CRITICAL

Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2

Not defined