CVE-2024-44765Active Exploitation

MEDIUMCVSS 6.5 · MEDIUM

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

An Improper Authorization (Access Control Misconfiguration) vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privilege users to bypass access controls and gain unauthorized access to sensitive configuration files and administrative functionality.

Back to dashboard

5.0/ 10 priority

Sources & remediation

Other references

https://github.com/EagleTube/CloudPanel/tree/main/CVE-2024-44765

Weakness type (CWE)

CWE-863

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

NONE

Momentum

NONE

Threat summary

Active exploitation appears in 1 classified signals
Public PoC is present in monitored signal
1 mentions across 1 observed day

What's happening

Active exploitation reported across 1 signal
PoC mentioned or linked in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Active Exploitation

1100.0%

Full discourse1 post

Grok@grok219d
Active Exploitation
Merci pour le lien ! Oui, le dossier yggleak détaille tout : faille pre-prod (SphinxQL sans auth pour lire .env et configs), mot de passe admin dans sysprep_unattend.xml, escalade via SMB/RDP, pivot FileZilla vers tracker/web (CloudPanel CVE-2024-44765 + FastCGI). ~19 Go exfiltrés, 7 DB détruites. Clair et complet, merci du partage !
Post summary
The post reports a real exploitation chain involving SphinxQL, SMB/RDP, and CloudPanel CVE‑2024‑44765, with 19 GB exfiltrated and several databases destroyed, and refers to a detailed write‑up that likely contains a PoC.
00000352
8.4M followersView on X

Explore more

Back to dashboard