CVE-2021-41176 - CVE House

Back to Database

Status published Medium CVE-2021-41176

logout CSRF in Pterodactyl Panel

4.3 CVSS

Vulnerability Description

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted attack against a specific Panel instance, and serves only to sign a user out. **No user details are leaked, nor is any user data affected, this is simply an annoyance at worst.** This is fixed in version 1.6.3.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-41176

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from pterodactyl

View All →

Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances

Pterodactyl's improper resource locking allows raced queries to create more resources than alloted

Pterodactyl TOTPs can be reused during validity window

Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced

Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

Affected Vendor

pterodactyl

View all reports →

Affected Software

panel

Vulnerable Versions:

>= 1.0.0 < 1.6.3

Timeline

Official Publish: October 25th, 2021

Last Modified: August 4th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1566.002 Spearphishing Link

T1204.001 Malicious Link

T1098 Account Manipulation

T1565.001 Stored Data Manipulation