← Back

CVE-2024-34066

nvd nist
Published: May 3, 2024Modified: Jun 17, 2026

JSON object

Loading...
8.4
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Exploitability: 1.7 / Impact: 6.0
Source: NVD

Description

Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to. This issue has been addressed in version 1.11.12 and users are advised to upgrade. Users unable to upgrade may enable the `ignore_panel_config_updates` option as a workaround.

Affected (1)

Products: Pterodactyl: Wings
Pterodactyl
1 product
Wings
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Wings
Before 1.11.2

Related CWEs

CWE-552
Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.

References (4)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
MitigationPatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Patch
Source: af854a3a-2127-422b-91ae-364da2661108
MitigationPatchVendor Advisory

Timeline

No history available yet.