CVE-2023-0391 MGT-COMMERCE CloudPanel Shared Certificate
CloudPanel uses a shared static SSL certificate, allowing attackers to decrypt administrative traffic and bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-0391?
CVE-2023-0391 is a high-severity vulnerability in MGT-COMMERCE CloudPanel, published on 21 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every installation of CloudPanel. This behavior was observed in version 2.2.0. There has been no indication from the vendor this has been addressed in version 2.2.1.
Which versions are affected by CVE-2023-0391?
It affects 1 product.
Products include Mgt-Commerce Cloudpanel.
How do I fix CVE-2023-0391?
No fix has been published for CVE-2023-0391 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-0391 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0391 exists.
Other vulnerabilities in MGT-COMMERCE CloudPanel
Sources
Also known as GHSA-4gcf-523q-9gmp.