x/vulndb: potential Go vuln in github.com/1Panel-dev/1Panel: CVE-2023-39965

[GoVulnBot]

CVE-2023-39965 references github.com/1Panel-dev/1Panel, which may be a Go module.

Description:
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. Attackers can freely download the file content on the target system. This may cause a large amount of information leakage. Version 1.5.0 has a patch for this issue.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-39965
• JSON: https://github.com/CVEProject/cvelist/tree/15470bd59477ad83ab74bc1a03a73c636e0e242c/2023/39xxx/CVE-2023-39965.json
• advisory: GHSA-85cf-gj29-f555
• web: https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0
• Imported by: https://pkg.go.dev/github.com/1Panel-dev/1Panel?tab=importedby

Cross references:

• Module github.com/1Panel-dev/1Panel appears in issue x/vulndb: potential Go vuln in github.com/1Panel-dev/1Panel: CVE-2023-36457 #1887 NOT_IMPORTABLE
• Module github.com/1Panel-dev/1Panel appears in issue x/vulndb: potential Go vuln in github.com/1Panel-dev/1Panel: CVE-2023-36458 #1888 EFFECTIVELY_PRIVATE
• Module github.com/1Panel-dev/1Panel appears in issue x/vulndb: potential Go vuln in github.com/1Panel-dev/1Panel: CVE-2023-37477 #1940 EFFECTIVELY_PRIVATE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/1Panel-dev/1Panel
      vulnerable_at: 1.5.0
      packages:
        - package: 1Panel
description: |-
    1Panel is an open source Linux server operation and maintenance management
    panel. In version 1.4.3, authenticated attackers can download arbitrary files
    through the API interface. This code has unauthorized access. Attackers can
    freely download the file content on the target system. This may cause a large
    amount of information leakage. Version 1.5.0 has a patch for this issue.
cves:
    - CVE-2023-39965
references:
    - advisory: https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-85cf-gj29-f555
    - web: https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0

[gopherbot]

Change https://go.dev/cl/518695 mentions this issue: data/excluded: batch add 3 excluded reports

[gopherbot]

Change https://go.dev/cl/592762 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606790 mentions this issue: data/reports: unexclude 20 reports (10)