data/reports: add GO-2024-2613.yaml

Aliases: CVE-2024-27288, GHSA-26w3-q4j8-4xjp Fixes #2613 Change-Id: I10d57e81e0dcb565ba6afd9521ce82f9e8076d0f Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/570720 Reviewed-by: Tatiana Bradley <[email protected]> LUCI-TryBot-Result: Go LUCI <[email protected]>
golang · Mar 14, 2024 · c84c60a · c84c60a
1 parent 20ac668
commit c84c60a
Show file tree

Hide file tree

Showing 2 changed files with 70 additions and 0 deletions.
diff --git a/data/osv/GO-2024-2613.json b/data/osv/GO-2024-2613.json
@@ -0,0 +1,51 @@
+{
+  "schema_version": "1.3.1",
+  "id": "GO-2024-2613",
+  "modified": "0001-01-01T00:00:00Z",
+  "published": "0001-01-01T00:00:00Z",
+  "aliases": [
+    "CVE-2024-27288",
+    "GHSA-26w3-q4j8-4xjp"
+  ],
+  "summary": "Unauthorized Console access in github.com/1Panel-dev/1Panel",
+  "details": "If the user attempts to access a secure entry point and intercepts with Burp, they can get access to the console page. This access does not return data nor allow modification operations.",
+  "affected": [
+    {
+      "package": {
+        "name": "github.com/1Panel-dev/1Panel",
+        "ecosystem": "Go"
+      },
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.10.1-lts"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {}
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-26w3-q4j8-4xjp"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/1Panel-dev/1Panel/releases/tag/v1.10.1-lts"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/1Panel-dev/1Panel/pull/4014"
+    }
+  ],
+  "database_specific": {
+    "url": "https://pkg.go.dev/vuln/GO-2024-2613"
+  }
+}
diff --git a/data/reports/GO-2024-2613.yaml b/data/reports/GO-2024-2613.yaml
@@ -0,0 +1,19 @@
+id: GO-2024-2613
+modules:
+    - module: github.com/1Panel-dev/1Panel
+      versions:
+        - fixed: 1.10.1-lts
+      vulnerable_at: 1.9.6
+summary: Unauthorized Console access in github.com/1Panel-dev/1Panel
+description: |-
+    If the user attempts to access a secure entry point and intercepts with Burp,
+    they can get access to the console page. This access does not return data nor
+    allow modification operations.
+cves:
+    - CVE-2024-27288
+ghsas:
+    - GHSA-26w3-q4j8-4xjp
+references:
+    - advisory: https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-26w3-q4j8-4xjp
+    - web: https://github.com/1Panel-dev/1Panel/releases/tag/v1.10.1-lts
+    - fix: https://github.com/1Panel-dev/1Panel/pull/4014