CVE-2024-24768: 1panel — Fix

Description

1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue has been patched in version 1.9.6.

Is your site exposed to CVE-2024-24768?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Weakness Type (CWE)

CWE-315 CWE-315

CWE-311 CWE-311

Affected Products

Vendor	Product	Versions
fit2cloud	1panel	All

References

Advisories & Patches

https://github.com/1Panel-dev/1Panel/commit/1169648162c4b9b48e0b4aa508f9dea4d6bc50d5 https://github.com/1Panel-dev/1Panel/pull/3817 https://github.com/1Panel-dev/1Panel/commit/1169648162c4b9b48e0b4aa508f9dea4d6bc50d5 https://github.com/1Panel-dev/1Panel/pull/3817

Other References

https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-9xfw-jjq2-7v8h https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-9xfw-jjq2-7v8h

Frequently Asked Questions

What is CVE-2024-24768? +

1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue has been patched in version 1.9.6. It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2024-24768? +

CVE-2024-24768 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-24768? +

CVE-2024-24768 affects products from fit2cloud, specifically: 1panel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-24768? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-41290 8.1

FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component.

CVE-2024-8644 7.5

Cleartext Storage of Sensitive Information in a Cookie vulnerability in Oceanic Software ValeApp allows Protocol Manipulation, : JSON Hijacking (aka …

CVE-2025-8528 3.7

A vulnerability classified as problematic has been found in Exrick xboot up to 3.3.4. Affected is an unknown function of …

CVE-2025-4537 3.1

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some …

CVE-2024-39911 10.0

1Panel is a web-based linux server management control panel. 1Panel contains an unspecified sql injection via User-Agent handling. This issue …

CVE-2024-40628 10.0

JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access …

CVE-2024-24768