Security Advisory

CVE-2018-12678

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2018-06-22 18:00:00

Last updated 2024-09-17 00:21:48

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocket/exec endpoint, which allows remote attackers to bypass intended access restrictions or conduct SSRF attacks.

← Browse all CVEs View on cve.org ↗