Products
Pterodactyl Panel
- 1.11.2
Source
security-advisories@github.com
Tags
CVE-2024-34068 details
Last Modified : May 3, 2024, 6:15 p.m.
Description
Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously implemented access control (GHSA-6rg3-8h8x-5xfv) that prevents accessing internal endpoints of the node hosting Wings in the pull endpoint. This would allow malicious users to potentially access resources on local networks that would otherwise be inaccessible. This issue has been addressed in version 1.11.2 and users are advised to upgrade. Users unable to upgrade may enable the `api.disable_remote_download` option as a workaround.
CVSS Score
| 1 | 2 | 3 | 4 | 5 | 6.4 | 7 | 8 | 9 | 10 |
|---|
Weakness
| Weakness | Name | Description |
|---|
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
Base Score
6.4
Exploitability Score
Impact Score
Base Severity
MEDIUM
Vector String : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
References
| URL | Source |
|---|---|
| https://github.com/pterodactyl/wings/commit/c152e36101aba45d8868a9a0eeb890995e8934b8 | security-advisories@github.com |
| https://github.com/pterodactyl/wings/security/advisories/GHSA-6rg3-8h8x-5xfv | security-advisories@github.com |
| https://github.com/pterodactyl/wings/security/advisories/GHSA-qq22-jj8x-4wwv | security-advisories@github.com |