Vulnerability Description
CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There is /filemanager/upload (aka File Manager upload) unauthenticated remote code execution via shell metacharacters.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cyberpanel | Cyberpanel | < 2.3.5 |
Related Weaknesses (CWE)
References
- https://cwe.mitre.org/data/definitions/78.htmlProduct
- https://cyberpanel.net/KnowledgeBase/home/change-logs/Release Notes
- https://cyberpanel.net/blog/cyberpanel-v2-3-5Release Notes
- https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-prExploitThird Party Advisory
FAQ
What is CVE-2024-51568?
CVE-2024-51568 is a vulnerability with a CVSS score of 10.0 (CRITICAL). CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There is /filemanager/upload (aka File Manager upload) unauthentic...
How severe is CVE-2024-51568?
CVE-2024-51568 has been rated CRITICAL with a CVSS base score of 10.0/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2024-51568?
Check the references section above for vendor advisories and patch information. Affected products include: Cyberpanel Cyberpanel.