Cyber Resilience

CVE-2023-35885

Mgt-Commerce Cloudpanel 2.0.0 – 2.3.1

Public PoCHigh EPSS
Published
20 June 2023
Modified
09 December 2024
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.75 99.5th percentile
Risk Priority 97 floored blend · peak EPSS

Summary

CVE-2023-35885 is a critical-severity Reliance on Cookies without Validation and Integrity Checking (CWE-565) vulnerability in Mgt-Commerce Cloudpanel. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Web Session Cookie (T1550.004); ranked in the top 0.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CloudPanel 2 versions prior to 2.3.1 contain an insecure file-manager cookie authentication mechanism tracked as CVE-2023-35885. The flaw is rated 9.8 under CVSS 3.1 and is associated with CWE-565, indicating reliance on cookies without proper validation or integrity checks. The affected component allows unauthenticated network access to file-manager functionality in the CloudPanel control panel.

An attacker with network reachability can supply a crafted cookie to bypass authentication entirely. Successful exploitation grants full read, write, and delete access to files on the server, enabling complete compromise of confidentiality, integrity, and availability without any user interaction or prior credentials.

The vendor changelog for CloudPanel 2.3.1 addresses the issue through corrected cookie handling in the file-manager component. Public references, including a detailed disclosure and accompanying proof-of-concept repository, confirm that updating to the patched release resolves the authentication weakness.

EPSS for the vulnerability stands at 0.9412, indicating sustained exploitation interest following disclosure. Public artifacts such as the FallingSkies proof-of-concept further demonstrate practical attack feasibility against unpatched instances.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1550.004 Web Session Cookie Lateral Movement
Adversaries can use stolen session cookies to authenticate to web applications and services.
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
T1550 Use Alternate Authentication Material Lateral Movement
Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-0391Same product: Mgt-Commerce Cloudpanel
CVE-2024-24320Same product: Mgt-Commerce Cloudpanel
CVE-2023-33747Same product: Mgt-Commerce Cloudpanel
CVE-2023-36630Same product: Mgt-Commerce Cloudpanel
CVE-2023-46157Same product: Mgt-Commerce Cloudpanel
CVE-2024-21872Shared CWE-565
CVE-2026-5130Shared CWE-565
CVE-2024-9970Shared CWE-565
CVE-2025-31120Shared CWE-565
CVE-2025-2395Shared CWE-565

Affected Assets

mgt-commerce
cloudpanel
2.0.0 — 2.3.1

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-04 full match
prevents

Cookies commonly carry identity assertions; requiring their protection, conveyance, and verification directly eliminates the weakness.

PR.AA-03 mostly match
prevents

Strong authentication mechanisms reduce reliance on unvalidated cookies for identity and access decisions.

PR.DS-02 mostly match
prevents

Cryptographic integrity for data-in-transit directly mitigates tampering of cookies sent over the network.

PR.AA-05 partial match
prevents

Enforcing access policy and least privilege limits damage from cookie misuse but does not address cookie validation itself.

PR.DS-01 partial match
prevents

Integrity protections for data-at-rest can apply to cookie stores but do not cover validation during use.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect cookie-validation flaws but does not itself implement the required controls.

prevents

Application security requirements can mandate cookie validation, integrity protection, and server-side session handling.

prevents

Secure coding practices directly eliminate reliance on unvalidated cookies by requiring proper integrity checks and server-side verification.

prevents

Secure authentication mechanisms can enforce server-side validation and integrity checks that prevent reliance on untrusted cookies.

References