logo
Vulnerability feed
CONTRIBUTE

Vulnerability

warn

CVE-2024-51378

Reference to the description:

https://nvd.nist.gov/vuln/detail/CVE-2024-51378

Description:
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
Last updated date:
12/06/2024

Reports

alt

ACTIVELY EXPLOITED

Type:
exploitation
Confidence:
HIGH
Date of publishing:
10/29/2024
Reference url to background

https://nvd.nist.gov/vuln/detail/CVE-2024-51378

Type:
exploitation
Confidence:
HIGH
Date of publishing:
12/04/2024
Type:
exploit
Confidence:
HIGH
Date of publishing:
10/29/2024
Reference url to background

https://github.com/refr4g/CVE-2024-51378

Type:
exploit
Confidence:
HIGH
Date of publishing:
12/05/2024
Type:
exploit
Confidence:
HIGH
Date of publishing:
12/06/2024
Type:
exploit
Confidence:
HIGH
Date of publishing:
12/06/2024
Vulnerability FeedContributorsAboutBlog

@inTheWild

©2024

Privacy Policy