CVE-2024-44765
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
A vulnerability in CloudPanel versions 2.0.0 through 2.4.2 allows low-privilege users to bypass access controls and gain unauthorized access to sensitive configuration files and administrative functionality.
Risk Assessment
The organization is at risk of leaking sensitive configuration data and having the management panel taken over by unauthorized users, potentially leading to further attacks on the infrastructure.
Recommendation
Immediately update CloudPanel to version 2.4.3 or later, which includes a fix for this vulnerability.
Other vulnerabilities in CloudPanel
See all- CVE-2023-35885Critical
CloudPanel 2 before version 2.3.1 has insecure cookie authentication in the file manager.
- CVE-2023-36630High
In CloudPanel before version 2.3.1, insecure file upload leads to privilege escalation and authentication bypass.
- CVE-2023-33747High
CloudPanel version 2.2.2 allows attackers to execute a path traversal attack.
Original NVD description (English source)
An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privilege users to bypass access controls and gain unauthorized access to sensitive configuration files and administrative functionality.