CVE-2024-44765
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
A vulnerability in CloudPanel versions 2.0.0 through 2.4.2 allows low-privilege users to bypass access controls and gain unauthorized access to sensitive configuration files and administrative functionality.
Risk Assessment
The organization is at risk of leaking sensitive configuration data and having the management panel taken over by unauthorized users, potentially leading to further attacks on the infrastructure.
Recommendation
Immediately update CloudPanel to version 2.4.3 or later, which includes a fix for this vulnerability.
Other vulnerabilities in CloudPanel
See all- CVE-2023-35885Critical
CloudPanel 2 before version 2.3.1 has insecure cookie authentication in the file manager.
- CVE-2025-15241Low
A security vulnerability was detected in CloudPanel Community Edition up to version 2.5.1. It affects an unknown function in the /admin/users file of the HTTP Header Handler component. Manipulation of the Referer argument leads to an open redirect. The attack can be launched remotely. The exploit has been publicly disclosed. Upgrading to version 2.5.2 fixes the issue.
- CVE-2023-36630High
In CloudPanel before version 2.3.1, insecure file upload leads to privilege escalation and authentication bypass.
- CVE-2023-33747High
CloudPanel version 2.2.2 allows attackers to execute a path traversal attack.
Original NVD description (English source)
An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privilege users to bypass access controls and gain unauthorized access to sensitive configuration files and administrative functionality.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS