Detections
Analytics
SCA: security update for github.com/pterodactyl/wings (GHSA-494h-9924-xww9)
high Tenable Self-Hosted Container Security Plugin ID 410066
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Wings is the server control plane for Pterodactyl Panel. This vulnerability impacts anyone running the
affected versions of Wings. The vulnerability can potentially be used to access files and directories on
the host system. The full scope of impact is exactly unknown, but reading files outside of a server's base
directory (sandbox root) is possible. In order to use this exploit, an attacker must have an existing
"server" allocated and controlled by Wings. Details on the exploitation of this vulnerability are
embargoed until March 27th, 2024 at 18:00 UTC. In order to mitigate this vulnerability, a full rewrite of
the entire server filesystem was necessary. Because of this, the size of the patch is massive, however
effort was made to reduce the amount of breaking changes. Users are advised to update to version 1.11.9.
There are no known workarounds for this vulnerability. (CVE-2024-27102)
See Also
Plugin Details
Severity: High
ID: 410066
Version: Revision 1.13
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 5
Percentile: 94.5
Vendor
Vendor Severity: Critical
CVSS v2
Risk Factor: High
Base Score: 7.1
Temporal Score: 5.3
Vector: CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2024-27102
CVSS v3
Risk Factor: High
Base Score: 8.5
Temporal Score: 7.4
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 3/15/2024
Vulnerability Publication Date: 3/13/2024
Reference Information
CVE: CVE-2024-27102