Control Web Panel internal API missing authentication allows root-level actions
Web hosting panel can be hacked, letting attackers take the whole server.
Summary
Control Web Panel before 1.29 lets attackers reach an internal API and run root-privileged actions without a token. Servers running this web hosting panel are affected.
Affected when
- attacker can reach the loopback-only API service
What to do
Update to CWP 1.29 or later; 1.30 is the current release.
Products and platforms
CVE IDs
Sources
- Advisory: control-webpanel.com (opens in a new tab)
- Write-up: vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
Times
First published
First seen