CVE-2024-39907 in the critical feed json
a sqlinjection in 1Panel
published 2024-07-18 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-2266 , GHSA-5grx-v727-qmq6 , GO-2024-2990
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 29.2%
- EPSS 29.2% chance of exploitation in 30 days, percentile 98%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have been resolved in version 1.10.12-tls. Users are advised to upgrade. There are no known workarounds for these issues.
Patch / fix
- go github.com/1Panel-dev/1Panel 1.10.12-tls
- fit2cloud 1panel 1.10.12-lts
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
29.18% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template 1Panel SQL Injection - Authenticated nuclei detection template
- github.com https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-5grx-v727-qmq6 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/1Panel-dev/1Panel | <1.10.12-tls all versions |
1.10.12-tls |
Affected products
- 1Panel-dev 1Panel
- fit2cloud 1panel
Classification
- Weakness
-
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
-
github.com
/1Panel-dev/1Panel/commit/ff549a47937c1314e6ee08453a1d2128242440cd
web, patch
-
github.com
/1Panel-dev/1Panel/security/advisories/GHSA-5grx-v727-qmq6
web, exploit, third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-39907
advisory
-
github.com
/1Panel-dev/1Panel
package
Sources
- CVE List CVE-2024-39907
- GitHub Advisory GHSA-5grx-v727-qmq6
- NVD CVE-2024-39907
- OSV GO-2024-2990
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.