XSS in Pterodactyl Panel
CVE-2024-34067
Pterodactyl is a free, open-source game server management panel built with PHP, React, and Go. Importing a malicious egg or gaining access to wings instance could lead to cross site scripting (XSS) on the panel, which could be used to gain…
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.005 (67.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Pterodactyl Panel — versions < 1.11.6
Weakness classification (CWE)
References
- https://github.com/pterodactyl/panel/security/advisories/GHSA-384w-wffr-x63q (x_refsource_CONFIRM)
- https://github.com/pterodactyl/panel/commit/0dad4c5a488661f9adc27dd311542516d9bfa0f2 (x_refsource_MISC)
- https://github.com/pterodactyl/panel/commit/1172d71d31561c4e465dabdf6b838e64de48ad16 (x_refsource_MISC)
- https://github.com/pterodactyl/panel/commit/f671046947e4695b5e1c647df79305c1cefdf817 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2024-34067?
- CVE-2024-34067 is a medium-severity vulnerability in Pterodactyl Panel, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2024-05-03.
- How severe is CVE-2024-34067?
- Medium severity. CVSS v3 base score is 6.1 out of 10.