Search/CVE-2024-34066
● CVE — High

CVE-2024-34066

VendorpterodactylProductwingsDiscoveredMay 3, 2024UpdatedFeb 21, 2025

Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to. This issue has been addressed in version 1.11.12 and users are advised to upgrade. Users unable to upgrade may enable the ignore_panel_config_updates option as a workaround.

CVSS v3.1
8.4 HIGH
EPSS
0.54%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredHIGH
User InteractionREQUIRED
ScopeCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Connections
2 relationships
Timeline
disclosure → media coverage
May 3, 2024
Disclosure — published as a CVE record. · last revised by NVD Feb 21, 2025