x/vulndb: potential Go vuln in github.com/1Panel-dev/1Panel: CVE-2023-39964

[GoVulnBot]

CVE-2023-39964 references github.com/1Panel-dev/1Panel, which may be a Go module.

Description:
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, arbitrary file reads allow an attacker to read arbitrary important configuration files on the server. In the api/v1/file.go file, there is a function called LoadFromFile, which directly reads the file by obtaining the requested path parameter[path]. The request parameters are not filtered, resulting in a background arbitrary file reading vulnerability. Version 1.5.0 has a patch for this issue.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-39964
• JSON: https://github.com/CVEProject/cvelist/tree/15470bd59477ad83ab74bc1a03a73c636e0e242c/2023/39xxx/CVE-2023-39964.json
• advisory: GHSA-pv7q-v9mv-9mh5
• web: https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0
• Imported by: https://pkg.go.dev/github.com/1Panel-dev/1Panel?tab=importedby

Cross references:

• Module github.com/1Panel-dev/1Panel appears in issue x/vulndb: potential Go vuln in github.com/1Panel-dev/1Panel: CVE-2023-36457 #1887 NOT_IMPORTABLE
• Module github.com/1Panel-dev/1Panel appears in issue x/vulndb: potential Go vuln in github.com/1Panel-dev/1Panel: CVE-2023-36458 #1888 EFFECTIVELY_PRIVATE
• Module github.com/1Panel-dev/1Panel appears in issue x/vulndb: potential Go vuln in github.com/1Panel-dev/1Panel: CVE-2023-37477 #1940 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/1Panel-dev/1Panel
      vulnerable_at: 1.5.0
      packages:
        - package: 1Panel
description: |-
    1Panel is an open source Linux server operation and maintenance management
    panel. In version 1.4.3, arbitrary file reads allow an attacker to read
    arbitrary important configuration files on the server. In the `api/v1/file.go`
    file, there is a function called `LoadFromFile`, which directly reads the file
    by obtaining the requested path `parameter[path]`. The request parameters are
    not filtered, resulting in a background arbitrary file reading vulnerability.
    Version 1.5.0 has a patch for this issue.
cves:
    - CVE-2023-39964
references:
    - advisory: https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-pv7q-v9mv-9mh5
    - web: https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0

[gopherbot]

Change https://go.dev/cl/518695 mentions this issue: data/excluded: batch add 3 excluded reports

[gopherbot]

Change https://go.dev/cl/592762 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606790 mentions this issue: data/reports: unexclude 20 reports (10)