Detections
Analytics
SCA: security update for pterodactyl/panel (GHSA-384w-wffr-x63q)
medium Tenable Self-Hosted Container Security Plugin ID 409387
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Pterodactyl is a free, open-source game server management panel built with PHP, React, and Go. Importing a
malicious egg or gaining access to wings instance could lead to cross site scripting (XSS) on the panel,
which could be used to gain an administrator account on the panel. Specifically, the following things are
impacted: Egg Docker images and Egg variables: Name, Environment variable, Default value, Description,
Validation rules. Additionally, certain fields would reflect malicious input, but it would require the
user knowingly entering such input to have an impact. To iterate, this would require an administrator to
perform actions and can't be triggered by a normal panel user. This issue has has been addressed in
version 1.11.6 and users are advised to upgrade. No workaround is available other than updating to the
latest version of the panel. (CVE-2024-34067)
See Also
Plugin Details
Severity: Medium
ID: 409387
Version: Revision 1.8
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 2.3
Percentile: 9.33
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2024-34067
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 5.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 5/3/2024
Vulnerability Publication Date: 5/3/2024
Reference Information
CVE: CVE-2024-34067
cwe: CWE-79