CVE-2024-27288

MEDIUM

1Panel < 1.10.1-lts - Unauthenticated Incorrect Authorization

Title source: llm

Description

1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access to the console page. The vulnerability has been fixed in v1.10.1-lts. There are no known workarounds.

References (2)

Core 2

Core References

Exploit, Vendor Advisory x_refsource_confirm

https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-26w3-q4j8-4xjp

Release Notes x_refsource_misc

https://github.com/1Panel-dev/1Panel/releases/tag/v1.10.1-lts

Scores

CVSS v3 6.3

EPSS 0.0047

EPSS Percentile 37.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-863

Status published

Products (2)

1Panel-dev/1Panel 0 - 1.10.1-ltsGo

fit2cloud/1panel < 1.10.1-lts

Published Mar 06, 2024

Tracked Since Feb 18, 2026