GitHub Advisoryadvisory · Packagist

GHSA-m49f-hcxp-6hm6 pterodactyl/panel CSRF allowing an external page to trigger a user logout event

LOW Published 2021-10-25 Modified 2023-09-20 Official page ↗
Aliases
CVE-2021-41176
Ecosystem
Packagist
Packages
pterodactyl/panel
Severity
Low
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N
Weaknesses
CWE-352
Reviewed
2021-10-25

Affected packages

• Packagist pterodactyl/panel: >= 1.0.0, < 1.6.3 → fixed in 1.6.3

Description

Impact A malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted attack against a specific Panel instance, and serves only to sign a user out. No user details are leaked, nor is any user data affected, this is simply an annoyance at worst. Patches None. Workarounds None. For more information If you have any questions or comments about this advisory please contact `Tactical Fish#8008` on Discord, or email `[email protected]`.

Related

Alias · CVE (1)

  • CVE-2021-41176 Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References