CVE-2021-41176
Medium
Description
Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted attack against a specific Panel instance, and serves only to sign a user out. **No user details are leaked, nor is any user data affected, this is simply an annoyance at worst.** This is fixed in version 1.6.3.
SeverityMedium
CVSS4.3
Exploit probability—
Product
Pterodactyl Panel
PublishedOct 25, 2021
First seenOct 25, 2021
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Update
- pterodactyl panel1.6.3 or later
- pterodactyl/panel1.6.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pterodactyl panel | v < 1.6.3 | 1.6.3 |
| pterodactyl/panelPackagist | 1.0.0 ≤ v < 1.6.3 | 1.6.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.