Detections
Analytics

SCA: security update for pterodactyl/panel (GHSA-c479-wq8g-57hr)

medium Tenable Self-Hosted Container Security Plugin ID 413639

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Pterodactyl is a free, open-source game server management panel. When a user disables two-factor
 authentication via the Panel, a `DELETE` request with their current password in a query parameter will be
 sent. While query parameters are encrypted when using TLS, many webservers (including ones officially
 documented for use with Pterodactyl) will log query parameters in plain-text, storing a user's password in
 plain text. Prior to version 1.11.8, if a malicious user obtains access to these logs they could
 potentially authenticate against a user's account; assuming they are able to discover the account's email
 address or username separately. This problem has been patched in version 1.11.8. There are no workarounds
 at this time. There is not a direct vulnerability within the software as it relates to logs generated by
 intermediate components such as web servers or Layer 7 proxies. Updating to `v1.11.8` or adding the linked
 patch manually are the only ways to avoid this problem. As this vulnerability relates to historical
 logging of sensitive data, users who have ever disabled 2FA on a Panel (self-hosted or operated by a
 company) should change their passwords and consider enabling 2FA if it was left disabled. While it's
 unlikely that their account swill be compromised by this vulnerability, it's not impossible. Panel
 administrators should consider clearing any access logs that may contain sensitive data. (CVE-2024-49762)

See Also

https://github.com/advisories/GHSA-c479-wq8g-57hr

Plugin Details

Severity: Medium

ID: 413639

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.07

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Low

Base Score: 2.9

Temporal Score: 2.1

Vector: CVSS2#AV:L/AC:L/Au:M/C:P/I:P/A:N

CVSS Score Source: CVE-2024-49762

CVSS v3

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 4

Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/24/2024

Vulnerability Publication Date: 10/24/2024

Reference Information

CVE: CVE-2024-49762

cwe: CWE-313