Detections
Analytics
SCA: security update for github.com/pterodactyl/wings (GHSA-p8r3-83r8-jwj5)
high Tenable Cloud Security Plugin ID 417407
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Wings is Pterodactyl's server control plane. Affected versions are subject to a vulnerability which can be
used to create new files and directory structures on the host system that previously did not exist,
potentially allowing attackers to change their resource allocations, promote their containers to
privileged mode, or potentially add ssh authorized keys to allow the attacker access to a remote shell on
the target machine. In order to use this exploit, an attacker must have an existing "server" allocated and
controlled by the Wings Daemon. This vulnerability has been resolved in version `v1.11.3` of the Wings
Daemon, and has been back-ported to the 1.7 release series in `v1.7.3`. Anyone running `v1.11.x` should
upgrade to `v1.11.3` and anyone running `v1.7.x` should upgrade to `v1.7.3`. There are no known
workarounds for this vulnerability. ### Workarounds None at this time. (CVE-2023-25152)
See Also
Plugin Details
Severity: High
ID: 417407
Version: Revision 1.9
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.58
Vendor
Vendor Severity: High
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 6.7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2023-25152
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 2/8/2023
Vulnerability Publication Date: 2/8/2023
Reference Information
CVE: CVE-2023-25152