{"id":"CVE-2024-30257","aliases":["EUVD-2024-1127","GHSA-6m9h-2pr2-9j8f","GO-2024-2734"],"status":"published","title":"1Panel's password verification is suspected to have a timing attack vulnerability","description":"1Panel is an open source Linux server operation and maintenance management panel. The password verification in the source code uses the != symbol instead hmac.Equal. This may lead to a timing attack vulnerability. This vulnerability is fixed in 1.10.3-lts.","severity":{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0038,"percentile":0.32483,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-203"],"published":"2024-04-18T14:56:56Z","modified":"2026-10-28T02:31:13Z","fixes":[{"ecosystem":"Go","package":"github.com/1Panel-dev/1Panel","fixed_in":["1.10.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/1Panel-dev/1Panel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/1Panel-dev/1Panel","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.10.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/1Panel-dev/1Panel","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]}],"products":[{"vendor":"1panel-dev","product":"1panel"},{"vendor":"fit2cloud","product":"1panel"}],"references":[{"url":"https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-6m9h-2pr2-9j8f","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26","tags":["x_refsource_MISC","x_transferred","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-30257","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-6m9h-2pr2-9j8f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/30xxx/CVE-2024-30257.json","tags":["advisory"]},{"url":"https://github.com/1Panel-dev/1Panel","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-30257","title":"1Panel's password verification is suspected to have a timing attack vulnerability","description":"1Panel is an open source Linux server operation and maintenance management panel. The password verification in the source code uses the != symbol instead hmac.Equal. This may lead to a timing attack vulnerability. This vulnerability is fixed in 1.10.3-lts.","status":"published","published":"2024-04-18T14:56:56.27Z","modified":"2024-08-02T01:32:05.409Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:34:07.831255Z"}],"euvd":[{"id":"EUVD-2024-1127","description":"1Panel is an open source Linux server operation and maintenance management panel. The password verification in the source code uses the != symbol instead hmac.Equal. This may lead to a timing attack vulnerability. This vulnerability is fixed in 1.10.3-lts.","status":"published","published":"2024-04-18T14:56:56Z","modified":"2024-08-02T01:32:05Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"}],"updated_at":"2026-11-03T03:50:25.17251Z"}],"ghsa":[{"id":"GHSA-6m9h-2pr2-9j8f","title":"1Panel's password verification is suspected to have a timing attack vulnerability","description":"### Summary\n源码中密码校验处使用 != 符号，而不是`hmac.Equal`，这可能导致产生计时攻击漏洞，从而爆破密码。  \n建议使用 `hmac.Equal` 比对密码。\n\nTranslation:\n\nThe source code uses the != symbol instead of hmac.Equal for password verification, which may lead to timing attack vulnerabilities that can lead to password cracking. It is recommended to use hmac. Equal to compare passwords.\n\n### Details\nhttps://github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26\n\n### Impact\n该产品的所有使用者。\n\nTranslation:\n\nAll users of this product.","status":"published","published":"2024-04-18T16:44:16Z","modified":"2025-02-11T19:02:39Z","cvss":[{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"low"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:38:30.754382Z"}],"nvd":[{"id":"CVE-2024-30257","description":"1Panel is an open source Linux server operation and maintenance management panel. The password verification in the source code uses the != symbol instead hmac.Equal. This may lead to a timing attack vulnerability. This vulnerability is fixed in 1.10.3-lts.","status":"published","published":"2024-04-18T15:15:30.043Z","modified":"2026-06-17T07:26:37.19Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T14:09:52.184911Z"}],"osv":[{"id":"CVE-2024-30257","title":"1Panel's password verification is suspected to have a timing attack vulnerability","description":"1Panel is an open source Linux server operation and maintenance management panel. The password verification in the source code uses the != symbol instead hmac.Equal. This may lead to a timing attack vulnerability. This vulnerability is fixed in 1.10.3-lts.","status":"published","published":"2024-04-18T14:56:56.27Z","modified":"2026-10-28T02:31:13.731305707Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L","level":"low"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T15:44:40.06138Z"},{"id":"GHSA-6m9h-2pr2-9j8f","title":"1Panel's password verification is suspected to have a timing attack vulnerability","description":"### Summary\n源码中密码校验处使用 != 符号，而不是`hmac.Equal`，这可能导致产生计时攻击漏洞，从而爆破密码。  \n建议使用 `hmac.Equal` 比对密码。\n\nTranslation:\n\nThe source code uses the != symbol instead of hmac.Equal for password verification, which may lead to timing attack vulnerabilities that can lead to password cracking. It is recommended to use hmac. Equal to compare passwords.\n\n### Details\nhttps://github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26\n\n### Impact\n该产品的所有使用者。\n\nTranslation:\n\nAll users of this product.","status":"published","published":"2024-04-18T16:44:16Z","modified":"2026-09-10T03:50:11.15701472Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":2,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-203"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"GO-2024-2734","title":"1Panel's password verification is suspected to have a timing attack vulnerability in github.com/1Panel-dev/1Panel","description":"1Panel's password verification is suspected to have a timing attack vulnerability in github.com/1Panel-dev/1Panel.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: github.com/1Panel-dev/1Panel before v1.10.3.","status":"published","published":"2024-06-05T15:10:52Z","modified":"2024-07-09T19:33:56Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}