CVE-2023-35885
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk99th percentile - higher than 99% of all known CVEs
Summary
CloudPanel 2 before version 2.3.1 has insecure cookie authentication in the file manager.
Risk Assessment
Insecure cookie authentication may lead to unauthorized access to files and user data, posing a significant security risk.
Recommendation
It is recommended to update CloudPanel to version 2.3.1 or later to mitigate this vulnerability.
Other vulnerabilities in CloudPanel
See all- CVE-2025-15241Low
A security vulnerability was detected in CloudPanel Community Edition up to version 2.5.1. It affects an unknown function in the /admin/users file of the HTTP Header Handler component. Manipulation of the Referer argument leads to an open redirect. The attack can be launched remotely. The exploit has been publicly disclosed. Upgrading to version 2.5.2 fixes the issue.
- CVE-2024-44765Medium
A vulnerability in CloudPanel versions 2.0.0 through 2.4.2 allows low-privilege users to bypass access controls and gain unauthorized access to sensitive configuration files and administrative functionality.
- CVE-2023-36630High
In CloudPanel before version 2.3.1, insecure file upload leads to privilege escalation and authentication bypass.
- CVE-2023-33747High
CloudPanel version 2.2.2 allows attackers to execute a path traversal attack.
Original NVD description (English source)
CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS