~ / search / GHSA-m49f-hcxp-6hm6

GHSA-m49f-hcxp-6hm6

pterodactyl/panel CSRF allowing an external page to trigger a user logout event

Source: GitHub Advisory Database (reviewed) Low CVE-2021-41176

Packages

EcosystemPackageAffectedFixed in
Packagist pterodactyl/panel >= 1.0.0, < 1.6.3 1.6.3

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted attack against a specific Panel instance, and serves only to sign a user out. **No user details are leaked, nor is any user data affected, this is simply an annoyance at worst.** ### Patches None. ### Workarounds None. ### For more information If you have any questions or comments about this advisory please contact `Tactical Fish#8008` on Discord, or email `[email protected]`.

References

External links from the advisory. They lead to third-party sites.