CVE-2024-24768

Name of the Vulnerable Software and Affected Versions 1Panel versions prior to 1.9.6

Description The HTTPS cookie that comes with the 1Panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue affects everyone who has configured the panel for HTTPS.

Recommendations For versions prior to 1.9.6, update to version 1.9.6 to resolve the issue. As a temporary workaround, consider configuring HTTPS directly for the panel to minimize the risk of exploitation. Restrict access to the panel when using HTTP to prevent the cookie from being sent in plain text.