CVE-2018-12678

2018-06-2218:29:00

Google

osv.dev

9.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.7%

JSON

Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocket/exec endpoint, which allows remote attackers to bypass intended access restrictions or conduct SSRF attacks.

CPENameOperatorVersion
portainereqinternal-1.4.0
portainereq1.15.2
portainereq1.16.2
portainereq1.8.1
portainereqinternal-1.5.0
portainereq1.16.3
portainereq1.5.0
portainereq1.13.2
portainereq1.10.2
portainereq1.12.2

Name	Operator	Version
portainer	eq	internal-1.4.0
portainer	eq	1.15.2
portainer	eq	1.16.2
portainer	eq	1.8.1
portainer	eq	internal-1.5.0
portainer	eq	1.16.3
portainer	eq	1.5.0
portainer	eq	1.13.2
portainer	eq	1.10.2
portainer	eq	1.12.2