← back
CVE-2018-12678

CVE-2018-12678

EPSS 2.3%
Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocket/exec endpoint, which allows remote attackers to bypass intended access restrictions or conduct SSRF attacks.
Affected products
n/a · n/a

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://github.com/portainer/portainer/pull/1979https://github.com/portainer/portainer/releases/tag/1.18.0