Headline
GHSA-x2vg-5wrf-vj6v: 1Panel is vulnerable to command injection
1Panel is vulnerable to command injection. This vulnerability has been classified as critical, has been found in 1Panel up to 1.10.1-lts. Affected by this issue is the function baseApi.UpdateDeviceSwap of the file /api/v1/toolbox/device/update/swap. The manipulation of the argument Path with the input 123123123\nopen -a Calculator leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-256304.
Skip to content
Actions
Automate any workflow
Packages
Host and manage packages
Security
Find and fix vulnerabilities
Codespaces
Instant dev environments
Copilot
Write better code with AI
Code review
Manage code changes
Issues
Plan and track work
Discussions
Collaborate outside of code
GitHub Sponsors
Fund open source developers
* The ReadME Project
GitHub community articles
- Pricing
Provide feedback
Saved searches****Use saved searches to filter your results more quickly
Sign up
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2024-2352
1Panel is vulnerable to command injection
Moderate severity GitHub Reviewed Published Mar 10, 2024 to the GitHub Advisory Database • Updated Mar 11, 2024
Package
gomod github.com/1Panel-dev/1Panel (Go)
Affected versions
< 1.10.1-lts
Patched versions
1.10.1-lts
Description
Published to the GitHub Advisory Database
Mar 10, 2024
Last updated
Mar 11, 2024