search

usmannasir / cyberpanel

Cyber Panel - The hosting control panel for OpenLiteSpeed
GNU General Public License v3.0
1.6k stars 613 forks source link

CyberPanel Vulnerabilities & production use #603

Closed xiaoyong-wang closed 3 years ago

xiaoyong-wang commented 3 years ago

Hello there, I was wondering if CyberPanel is ready for production use, and if there are any current known security holes that are unpatched.

I found these security issue threads & was wondering if they were all patched: https://www.cvedetails.com/product/56550/Cyberpanel-Cyberpanel.html?vendor_id=20009 https://nvd.nist.gov/vuln/detail/CVE-2019-13056 https://dptechnology.net/index.php?m=content&c=index&a=show&catid=1691&id=1692 https://rack911labs.ca/research/security-analysis-of-alternative-control-panels/

Thanks!

meramsey commented 3 years ago

there was only one thing and it was patched in 2019 and that only affected 1.8.4 were way long past that version on 2.1.1. So no that is not applicable at this time.

If you have anything NEW to report feel free but were not aware of any current issues.

xiaoyong-wang commented 3 years ago

there was only one thing and it was patched in 2019 and that only affected 1.8.4 were way long past that version on 2.1.1. So no that is not applicable at this time.

If you have anything NEW to report feel free but were not aware of any current issues.

One more question, would you say cyberpanel is ready for commercial/production use in terms of me selling hosting powered by cyberpanel?

In other words, does cyberpanel have just as much of a risk of getting hacked as the hosting panel giants cPanel/Plesk/DirectAdmin?

meramsey commented 3 years ago

Seems like the wrong questions to ask.

Everything has the same risk of being potentially hacked regardless of how big or small the target is. It's all about someone having the motivation and time to find some kind of exploit. Being large means any exploit is more valuable once discovered but potentially harder to find which is why whenever there is a wordpress exploit it really does some serious carnage but that doesn't make wordpress any less secure then some other CMS when kept up to date. Same goes for control panels.

Give it a try and see what you think. If your looking for production use and special kinds of features you should check out: https://cloud.cyberpanel.net/

xiaoyong-wang commented 3 years ago

Seems like the wrong questions to ask.

Everything has the same risk of being potentially hacked regardless of how big or small the target is. It's all about someone having the motivation and time to find some kind of exploit. Being large means any exploit is more valuable once discovered but potentially harder to find which is why whenever there is a wordpress exploit it really does some serious carnage but that doesn't make wordpress any less secure then some other CMS when kept up to date. Same goes for control panels.

Give it a try and see what you think. If your looking for production use and special kinds of features you should check out: https://cloud.cyberpanel.net/

Ill check out https://cloud.cyberpanel.net/ but was wondering if you would consider a VPS with self-hosted cyberpanel installed to be ready for production use, in other words, is it safe to host 500+ clients on my cyberpanel vps without worrying about getting hacked as long as i update cyberpanel frequently?