Improper Access Control Affecting github.com/1panel-dev/1panel/backend/router package, versions <1.5.0
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.06% (25th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOM1PANELDEV1PANELBACKENDROUTER-7814216
- published 23 Aug 2024
- disclosed 21 Aug 2024
- credit qiulongk
Introduced: 21 Aug 2024
CVE-2023-39965 Open this link in a new tabHow to fix?
Upgrade github.com/1Panel-dev/1Panel/backend/router to version 1.5.0 or higher.
Overview
Affected versions of this package are vulnerable to Improper Access Control via the file download functionality. An attacker can download files that should not be accessible by manipulating the input parameters.