CVE-2025-69199 (CNNVD-202601-3000)
中文标题:
Pterodactyl Panel 安全漏洞
英文标题:
Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances
漏洞描述
中文描述:
Pterodactyl Panel是Pterodactyl开源的一个免费的开源游戏服务器管理面板。 Pterodactyl Panel 1.12.0之前版本存在安全漏洞，该漏洞源于WebSocket缺乏适当的速率限制和节流以及对消息总大小没有限制，可能导致恶意用户打开大量连接并发送大量数据，造成主机系统内存、CPU和网络过载。
英文描述:
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.0, websockets within wings lack proper rate limiting and throttling. As a result a malicious user can open a large number of connections and then request data through these sockets, causing an excessive volume of data over the network and overloading the host system memory and cpu. Additionally, there is not a limit applied to the total size of messages being sent or received, allowing a malicious user to open thousands of websocket connections and then send massive volumes of information over the socket, overloading the host network, and causing increased CPU and memory load within Wings. Version 1.12.0 patches the issue.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| pterodactyl | panel | < 1.12.0 | - | - |
cpe:2.3:a:pterodactyl:panel:<_1.12.0:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
CVSS评分详情
4.0 (cna)
HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-69199 |
2026-01-20 02:17:10 | 2026-01-19 19:10:32 |
| NVD | nvd_CVE-2025-69199 |
2026-01-20 03:00:05 | 2026-01-19 19:10:37 |
| CNNVD | cnnvd_CNNVD-202601-3000 |
2026-01-26 02:10:03 | 2026-01-25 18:11:52 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202601-3000
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']