CVE-2024-30257 1Panel's password verification is suspected to have a timing attack vulnerability

2024-04-1814:56:56

CWE-203

GitHub_M

www.cve.org

1panel

password verification

timing attack

vulnerability

fixed

1.10.3-lts

3.9 Low

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L

4.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

1Panel is an open source Linux server operation and maintenance management panel. The password verification in the source code uses the != symbol instead hmac.Equal. This may lead to a timing attack vulnerability. This vulnerability is fixed in 1.10.3-lts.

CNA Affected

[
  {
    "vendor": "1Panel-dev",
    "product": "1Panel",
    "versions": [
      {
        "version": "< 1.10.3-lts",
        "status": "affected"
      }
    ]
  }
]