{"id":"CVE-2025-34429","sourceIdentifier":"disclosure@vulncheck.com","published":"2025-12-10T19:16:13.720","lastModified":"2026-10-14T21:10:00.183","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality. The port-change endpoint lacks CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a port-change request; when a victim visits it while authenticated, the browser includes valid session cookies and the request succeeds. This allows an attacker to change the port on which the 1Panel web service listens, causing loss of access on the original port and resulting in service disruption or denial of service, and may unintentionally expose the service on an attacker-chosen port."},{"lang":"es","value":"Las versiones 1.10.33?-?2.0.15 de 1Panel contienen una vulnerabilidad de Cross-Site Request Forgery (CSRF) en la funcionalidad de configuración del puerto web. El endpoint de cambio de puerto carece de defensas CSRF, como tokens anti?CSRF o validación Origin/Referer. Un atacante puede crear una página web maliciosa que envíe una solicitud de cambio de puerto; cuando una víctima la visita mientras está autenticada, el navegador incluye las cookies de sesión válidas y la solicitud se completa con éxito. Esto permite que un atacante cambie el puerto en el que el servicio web de 1Panel escucha, provocando pérdida de acceso en el puerto original y resultando en interrupción del servicio o denegación de servicio, y puede exponer inadvertidamente el servicio en un puerto elegido por el atacante."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"LXware","product":"1Panel","defaultStatus":"unknown","repo":"https://github.com/1Panel-dev/1Panel","packageURL":"pkg:golang/github.com/1Panel-dev/1Panel","versions":[{"version":"1.10.33","lessThanOrEqual":"2.0.15","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-11T16:07:26.907425Z","id":"CVE-2025-34429","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:fit2cloud:1panel:*:*:*:*:*:*:*:*","versionStartIncluding":"1.10.33-lts","versionEndIncluding":"2.0.15","matchCriteriaId":"4044A6FA-6EC3-4541-99AB-0FE6A1109FAF"}]}]}],"references":[{"url":"https://1panel.pro/","source":"disclosure@vulncheck.com","tags":["Product"]},{"url":"https://github.com/1Panel-dev/1Panel/releases","source":"disclosure@vulncheck.com","tags":["Product","Release Notes"]},{"url":"https://www.vulncheck.com/advisories/1panel-csrf-web-port-configuration-change","source":"disclosure@vulncheck.com","tags":["Third Party Advisory"]}]}