Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x/vulndb: potential Go vuln in github.com/1Panel-dev/1Panel: CVE-2023-39965 #2005

Closed
GoVulnBot opened this issue Aug 10, 2023 · 2 comments
Closed
Assignees
Labels
excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module.

Comments

@GoVulnBot
Copy link

CVE-2023-39965 references github.com/1Panel-dev/1Panel, which may be a Go module.

Description:
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. Attackers can freely download the file content on the target system. This may cause a large amount of information leakage. Version 1.5.0 has a patch for this issue.

References:

Cross references:

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/1Panel-dev/1Panel
      vulnerable_at: 1.5.0
      packages:
        - package: 1Panel
description: |-
    1Panel is an open source Linux server operation and maintenance management
    panel. In version 1.4.3, authenticated attackers can download arbitrary files
    through the API interface. This code has unauthorized access. Attackers can
    freely download the file content on the target system. This may cause a large
    amount of information leakage. Version 1.5.0 has a patch for this issue.
cves:
    - CVE-2023-39965
references:
    - advisory: https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-85cf-gj29-f555
    - web: https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0

@zpavlinovic zpavlinovic self-assigned this Aug 11, 2023
@zpavlinovic zpavlinovic added the excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module. label Aug 11, 2023
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/518695 mentions this issue: data/excluded: batch add 3 excluded reports

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/592762 mentions this issue: data/reports: unexclude 75 reports

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
excluded: EFFECTIVELY_PRIVATE This vulnerability exists in a package can be imported, but isn't meant to be outside that module.
Projects
None yet
Development

No branches or pull requests

3 participants