CVE-2024-51567CyberPanel Incorrect Default Permissions Vulnerability

upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.

10.0 CRITICALEPSS 84.40%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-08-04 05:16 UTC

OverviewCVSS details

10.0CRITICALCVSS 3.1

Score source: mitre (CNA)
NVD status: Analyzed
Published: Oct 29, 2024
Assigner: mitre

Affected

cyberpanel (cyberpanel)

Versions: before 2.3.8
Fixed in: 2.3.8

Exploitation

Public exploit: Yes · 1 reference
CISA KEV: Listed · Nov 7, 2024
KEV due date: Nov 28, 2024
Ransomware use: Known
SSVC: Exploitation active · Automatable yes · Impact total

EPSS · FIRST, scored Nov 7

84.40%chance of exploitation in 30 days

Higher than 99.70% of CVEs

CVSS 3.1 · mitre (CNA)

10.0Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Changed
Confidentiality impact: High
Integrity impact: High
Availability impact: High

CVSS 3.1 · mitre (CNA)

10.0Critical

CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N

Attack complexity: Low
Attack vector: Network
Availability impact: High
Confidentiality impact: High
Integrity impact: High
Privileges required: None
Scope: Changed
User interaction: None

CVSS 3.1 · NVD

9.8Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality impact: High
Integrity impact: High
Availability impact: High

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
10.0	CRITICAL	3.1mitre (CNA)	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
10.0	CRITICAL	3.1mitre (CNA)	CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
9.8	CRITICAL	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA required action

⚡ Known exploited · remediation due Nov 28, 2024

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Details

CVE ID: CVE-2024-51567
Status: Analyzed
Assigner (CNA): mitre
Published: Oct 29, 2024
Last modified: 2026-08-04 05:16 UTC
Weaknesses: CWE-306
CWE-276

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 12:41 UTC.