CVE-2024-24768

1Panel set-cookie is missing the Secure keyword

State: Published
Severity: 6.5 Medium
Published: Feb 5, 2024
Updated: Jun 17, 2025
Reserved: Jan 29, 2024

Description

1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue has been patched in version 1.9.6.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L	GitHub_M

Weaknesses

CWE-315 Cleartext Storage of Sensitive Information in a Cookie

Affected Products

Product	Versions
1Panel1Panel-dev	<= 1.9.5Affected

References

https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-9xfw-jjq2-7v8h
https://github.com/1Panel-dev/1Panel/pull/3817
https://github.com/1Panel-dev/1Panel/commit/1169648162c4b9b48e0b4aa508f9dea4d6bc50d5

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.