https://pwn.watch/t/cyberpanel Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Wed, 04 Dec 2024 00:00:00 GMT https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378 https://pwn.watch/i/cyberpersons-cyberpanel-cve-2024-51567-51378 Wed, 04 Dec 2024 00:00:00 GMT critical <p>CVE-2024-51567: CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root. CVE-2024-51378: CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property. Added to the CISA KEV catalog on 2024-11-07, 2024-12-04. CISA lists known use in ransomware campaigns.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2024-12-04: CISA added CVE-2024-51378 to the KEV catalog (federal deadline 2024-12-25) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li><li>2024-11-07: CISA added CVE-2024-51567 to the KEV catalog (federal deadline 2024-11-28) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li><li>2024-10-29: CVE-2024-51567 published (<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-51567">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2024-51567, CVE-2024-51378</p>