CVE-2018-12678

2022-10-0316:22:07

mitre

www.cve.org

portainer unauthenticated websocket

cve-2018-12678

ssrf attacks

9.6 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.7%

JSON

Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocket/exec endpoint, which allows remote attackers to bypass intended access restrictions or conduct SSRF attacks.