CVE-2018-12678

2018-06-2218:29:00

Google

osv.dev

AI Score

9.8

Confidence

High

EPSS

0.003

Percentile

70.7%

JSON

Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocket/exec endpoint, which allows remote attackers to bypass intended access restrictions or conduct SSRF attacks.