CVE-2023-0391

· HIGHModified

← All CVEs

CVSS v3.1

8.1

EPSS

0.60%

Published

Mar 21, 2023

Modified

Feb 26, 2025

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

MGT-COMMERCE CloudPanel ships with a static SSL certificate to encrypt communications to the administrative interface, shared across every installation of CloudPanel. This behavior was observed in version 2.2.0. There has been no indication from the vendor this has been addressed in version 2.2.1.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-321CWE-798

Affected Products (1)

mgt-commerce · cloudpanel (up to 2.2.1)vulnerable

References (4)

https://www.bleepingcomputer.com/news/security/cloudpanel-installations-use-the-same-ssl-certificate-private-key/

ExploitPress/Media CoverageThird Party Advisory

https://www.rapid7.com/blog/post/2023/03/21/cve-2023-0391-mgt-commerce-cloudpanel-shared-certificate-vulnerability-and-weak-installation-procedures/

ExploitThird Party Advisory

https://www.bleepingcomputer.com/news/security/cloudpanel-installations-use-the-same-ssl-certificate-private-key/

ExploitPress/Media CoverageThird Party Advisory

https://www.rapid7.com/blog/post/2023/03/21/cve-2023-0391-mgt-commerce-cloudpanel-shared-certificate-vulnerability-and-weak-installation-procedures/

ExploitThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs