CVE-2024-30257
1Panel's password verification is suspected to have a timing attack vulnerability
1Panel is an open source Linux server operation and maintenance management panel. The password verification in the source code uses the != symbol instead hmac.Equal. This may lead to a timing attack vulnerability. This vulnerability is fixed in 1.10.3-lts.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
1Panel's password verification is suspected to have a timing attack vulnerability
1Panel is an open source Linux server operation and maintenance management panel. The password verification in the source code uses the != symbol instead hmac.Equal. This may lead to a timing attack vulnerability. This vulnerability is fixed in 1.10.3-lts.
- Record
CVE-2024-30257- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-203
- Updated
- 2026-11-02
EUVDEUVD-2024-1127
1Panel is an open source Linux server operation and maintenance management panel. The password verification in the source code uses the != symbol instead hmac.Equal. This may lead to a timing attack vulnerability. This vulnerability is fixed in 1.10.3-lts.
- Record
EUVD-2024-1127- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6m9h-2pr2-9j8f
1Panel's password verification is suspected to have a timing attack vulnerability
Summary
源码中密码校验处使用 != 符号，而不是hmac.Equal，这可能导致产生计时攻击漏洞，从而爆破密码。
建议使用 hmac.Equal 比对密码。
Translation:
The source code uses the != symbol instead of hmac.Equal for password verification, which may lead to timing attack vulnerabilities that can lead to password cracking. It is recommended to use hmac. Equal to compare passwords.
Details
https://github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26
Impact
该产品的所有使用者。
Translation:
All users of this product.
- Record
GHSA-6m9h-2pr2-9j8f- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
NVD
1Panel is an open source Linux server operation and maintenance management panel. The password verification in the source code uses the != symbol instead hmac.Equal. This may lead to a timing attack vulnerability. This vulnerability is fixed in 1.10.3-lts.
- Record
CVE-2024-30257- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
OSV
1Panel's password verification is suspected to have a timing attack vulnerability
1Panel is an open source Linux server operation and maintenance management panel. The password verification in the source code uses the != symbol instead hmac.Equal. This may lead to a timing attack vulnerability. This vulnerability is fixed in 1.10.3-lts.
- Record
CVE-2024-30257- CVSS 3.1
- 3.9 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L - Weakness
- CWE-203
- Updated
- 2026-11-02
OSVGHSA-6m9h-2pr2-9j8f
1Panel's password verification is suspected to have a timing attack vulnerability
Summary
源码中密码校验处使用 != 符号，而不是hmac.Equal，这可能导致产生计时攻击漏洞，从而爆破密码。
建议使用 hmac.Equal 比对密码。
Translation:
The source code uses the != symbol instead of hmac.Equal for password verification, which may lead to timing attack vulnerabilities that can lead to password cracking. It is recommended to use hmac. Equal to compare passwords.
Details
https://github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26
Impact
该产品的所有使用者。
Translation:
All users of this product.
- Record
GHSA-6m9h-2pr2-9j8f- CVSS 4.0
- 2.0 Low
CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-203
- Updated
- 2026-11-02
OSVGO-2024-2734 No score
1Panel's password verification is suspected to have a timing attack vulnerability in github.com/1Panel-dev/1Panel
1Panel's password verification is suspected to have a timing attack vulnerability in github.com/1Panel-dev/1Panel.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/1Panel-dev/1Panel before v1.10.3.
- Record
GO-2024-2734- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/1Panel-dev/1PanelGo |
before 1.10.3 | 1.10.3 |
github.com/1Panel-dev/1PanelGo |
All versions | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-30257 is a low vulnerability (CVSS 3.9) in 1panel-dev 1panel, published April 18, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 32nd percentile. Fixed in github.com/1Panel-dev/1Panel 1.10.3.
References
github.com/1Panel-dev/1Panel/security/advisories/GHSA-6m9h-2pr2-9j8f
nvd.nist.gov/vuln/detail/CVE-2024-30257