CVE-2024-27288
1Panel open source panel project has an unauthorized vulnerability.
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access to the console page. The vulnerability has been fixed in v1.10.1-lts. There are no known workarounds.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
1Panel open source panel project has an unauthorized vulnerability.
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access to the console page. The vulnerability has been fixed in v1.10.1-lts. There are no known workarounds.
- Record
CVE-2024-27288- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2024-0784
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access to the console page. The vulnerability has been fixed in v1.10.1-lts. There are no known workarounds.
- Record
EUVD-2024-0784- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-26w3-q4j8-4xjp
1Panel open source panel project has an unauthorized vulnerability.
Impact
The steps are as follows:
-
Access https://IP:PORT/ in the browser, which prompts the user to access with a secure entry point.
-
Use Burp to intercept:
When opening the browser and entering the URL (allowing the first intercepted packet through Burp), the following is displayed:
It is found that in this situation, we can access the console page (although no data is returned and no modification operations can be performed)."
Affected versions: <= 1.10.0-lts
Patches
The vulnerability has been fixed in v1.10.1-lts.
Workarounds
It is recommended to upgrade the version to 1.10.1-lts.
References
If you have any questions or comments about this advisory:
Open an issue in https://github.com/1Panel-dev/1Panel Email us at [email protected]
- Record
GHSA-26w3-q4j8-4xjp- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-863
- Updated
- 2026-11-02
NVD
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access to the console page. The vulnerability has been fixed in v1.10.1-lts. There are no known workarounds.
- Record
CVE-2024-27288- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
1Panel open source panel project has an unauthorized vulnerability.
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access to the console page. The vulnerability has been fixed in v1.10.1-lts. There are no known workarounds.
- Record
CVE-2024-27288- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVGHSA-26w3-q4j8-4xjp
1Panel open source panel project has an unauthorized vulnerability.
Impact
The steps are as follows:
-
Access https://IP:PORT/ in the browser, which prompts the user to access with a secure entry point.
-
Use Burp to intercept:
When opening the browser and entering the URL (allowing the first intercepted packet through Burp), the following is displayed:
It is found that in this situation, we can access the console page (although no data is returned and no modification operations can be performed)."
Affected versions: <= 1.10.0-lts
Patches
The vulnerability has been fixed in v1.10.1-lts.
Workarounds
It is recommended to upgrade the version to 1.10.1-lts.
References
If you have any questions or comments about this advisory:
Open an issue in https://github.com/1Panel-dev/1Panel Email us at [email protected]
- Record
GHSA-26w3-q4j8-4xjp- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-863
- Updated
- 2026-11-02
OSVGO-2024-2613 No score
Unauthorized Console access in github.com/1Panel-dev/1Panel
If the user attempts to access a secure entry point and intercepts with Burp, they can get access to the console page. This access does not return data nor allow modification operations.
- Record
GO-2024-2613- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/1Panel-dev/1PanelGo |
through 1.10.0-lts | 1.10.1-lts |
github.com/1Panel-dev/1PanelGo |
before 1.10.1-lts | 1.10.1-lts |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-27288 is a medium vulnerability (CVSS 6.3) in 1panel-dev 1panel, published March 6, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in github.com/1Panel-dev/1Panel 1.10.1-lts.
References
github.com/1Panel-dev/1Panel/security/advisories/GHSA-26w3-q4j8-4xjp
nvd.nist.gov/vuln/detail/CVE-2024-27288