x/vulndb: potential Go vuln in github.com/1Panel-dev/1Panel: CVE-2023-39966

[GoVulnBot]

CVE-2023-39966 references github.com/1Panel-dev/1Panel, which may be a Go module.

Description:
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the api/v1/file.go file, there is a function called SaveContentthat,It recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations. Version 1.5.0 contains a patch for this issue.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-39966
• JSON: https://github.com/CVEProject/cvelist/tree/15470bd59477ad83ab74bc1a03a73c636e0e242c/2023/39xxx/CVE-2023-39966.json
• advisory: GHSA-hf7j-xj3w-87g4
• web: https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0
• Imported by: https://pkg.go.dev/github.com/1Panel-dev/1Panel?tab=importedby

Cross references:

• Module github.com/1Panel-dev/1Panel appears in issue x/vulndb: potential Go vuln in github.com/1Panel-dev/1Panel: CVE-2023-36457 #1887 NOT_IMPORTABLE
• Module github.com/1Panel-dev/1Panel appears in issue x/vulndb: potential Go vuln in github.com/1Panel-dev/1Panel: CVE-2023-36458 #1888 EFFECTIVELY_PRIVATE
• Module github.com/1Panel-dev/1Panel appears in issue x/vulndb: potential Go vuln in github.com/1Panel-dev/1Panel: CVE-2023-37477 #1940 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/1Panel-dev/1Panel
      vulnerable_at: 1.5.0
      packages:
        - package: 1Panel
description: |-
    1Panel is an open source Linux server operation and maintenance management
    panel. In version 1.4.3, an arbitrary file write vulnerability could lead to
    direct control of the server. In the `api/v1/file.go` file, there is a function
    called `SaveContentthat,It `recieves JSON data sent by users in the form of a
    POST request. And the lack of parameter filtering allows for arbitrary file
    write operations. Version 1.5.0 contains a patch for this issue.
cves:
    - CVE-2023-39966
references:
    - advisory: https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-hf7j-xj3w-87g4
    - web: https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0

[gopherbot]

Change https://go.dev/cl/518695 mentions this issue: data/excluded: batch add 3 excluded reports

[gopherbot]

Change https://go.dev/cl/592762 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606790 mentions this issue: data/reports: unexclude 20 reports (10)