CVE-2023-37477

    Dashboard / Vulnerabilities / CVE-2023-37477

    CVE-2023-37477

    Published: 18 Jul 2023Last Modified: 12 Aug 2026

    Summary: Command injection in firewall ip functionality in 1Panel

    Details: 1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. 1Panel firewall functionality `/hosts/firewall/ip` endpoint read user input without validation, the attacker extends the default functionality of the application, which execute system commands. An attacker can execute arbitrary code on the target system, which can lead to a complete compromise of the system. This issue has been addressed in commit `e17b80cff49` which is included in release version `1.4.3`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    References: https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-p9xf-74xh-mhw5, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37477.json, https://nvd.nist.gov/vuln/detail/CVE-2023-37477, https://github.com/1Panel-dev/1Panel/commit/e17b80cff4975ee343568ff526b62319f499005d

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -86ba53d6ec35fe2f0f3bcdb8c8d3c4cb2ef4cf1b

    Affected versions

    v1.4.2
    v1.4.1
    v1.4.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-37477 | CVE-DB