CyberPersons CyberPanel: 2 actively exploited vulnerabilities

Updates on Oct 29, 2024

Summary

CVE-2024-51567: CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root. CVE-2024-51378: CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property. Added to the CISA KEV catalog on 2024-11-07, 2024-12-04. CISA lists known use in ransomware campaigns.

Advisories5

• CyberPersons advisory: CVE-2024-51567CyberPersons
• CyberPersons advisory: CVE-2024-51378CyberPersons
• NVD: CVE-2024-51567NVD · Oct 29, 2024
• NVD: CVE-2024-51378NVD · Oct 29, 2024
• CISA Known Exploited Vulnerabilities CatalogCISA · Nov 7, 2024