CVE-2020-24263

2021-03-1615:15:12

Google

osv.dev

7.7 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

70.2%

JSON

Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead to remote arbitrary code execution. A non-admin user is allowed to spawn new containers with critical capabilities such as SYS_MODULE, which can be used to take over the Docker host.

CPENameOperatorVersion
portainereq1.15.5
portainereq1.8.1
portainereqinternal-1.3.0
portainereq1.17.1
portainereq1.11.2
portainereq1.22.0
portainereq1.21.0
portainereq1.14.1
portainereq1.23.0
portainereq1.12.1

Name	Operator	Version
portainer	eq	1.15.5
portainer	eq	1.8.1
portainer	eq	internal-1.3.0
portainer	eq	1.17.1
portainer	eq	1.11.2
portainer	eq	1.22.0
portainer	eq	1.21.0
portainer	eq	1.14.1
portainer	eq	1.23.0
portainer	eq	1.12.1