CVE-2024-2352
Medium
Description
A vulnerability, which was classified as critical, has been found in 1Panel up to 1.10.1-lts. Affected by this issue is the function baseApi.UpdateDeviceSwap of the file /api/v1/toolbox/device/update/swap. The manipulation of the argument Path with the input 123123123\nopen -a Calculator leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-256304.
SeverityMedium
CVSS6.3
Exploit probability—
ProductFit2cloud 1panel
PublishedMar 10, 2024
First seenMar 10, 2024
Weakness typeCWE-77Command injection
How to fix
Update
- fit2cloud 1panel1.10.2-lts or later
- github.com/1Panel-dev/1Panel1.10.1-lts or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fit2cloud 1panel | v < 1.10.2-lts | 1.10.2-lts |
| github.com/1Panel-dev/1PanelGo | v < 1.10.1-lts | 1.10.1-lts |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.