Lucene search

AtlassianCVE-2018-13390

HistoryAug 10, 2018 - 3:29 p.m.

CVE-2018-13390

2018-08-1015:29:00

atlassian

web.nvd.nist.gov

cve-2018-13390

unauthenticated access

cloudtoken daemon

linux

aws credentials

CVSS2

4.8

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:A/AC:L/Au:N/C:P/I:P/A:N

CVSS3

6.1

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

25.2%

JSON

Unauthenticated access to cloudtoken daemon on Linux via network from version 0.1.1 before version 0.1.24 allows attackers on the same subnet to gain temporary AWS credentials for the users’ roles.

Affected configurations

Nvd

Node

atlassiancloudtokenRange0.1.1–0.1.24

VendorProductVersionCPE
atlassiancloudtoken*cpe:2.3:a:atlassian:cloudtoken:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
atlassian	cloudtoken	*	cpe:2.3:a:atlassian:cloudtoken::::::::

CNA Affected

[
  {
    "product": "cloudtoken",
    "vendor": "Atlassian",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "0.1.1",
        "versionType": "custom"
      },
      {
        "lessThan": "0.1.24",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

bitbucket.org/atlassian/cloudtoken/wiki/CVE-2018-13390%20-%20Exposed%20credentials%20in%20daemon%20mode%20on%20Linux

CVSS2

4.8

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:A/AC:L/Au:N/C:P/I:P/A:N

CVSS3

6.1

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

25.2%

JSON

Related for CVE-2018-13390