PT-2019-9826 · Portainer · Portainer

Plaguedoktor · Publicado 2019-03-27 · Atualizado 2020-08-24 · CVE-2018-19466

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Portainer versions prior to 1.20.0

Description A vulnerability was found in Portainer where it stores LDAP credentials in cleartext, corresponding to a master password. These credentials can be retrieved via API calls.

Recommendations For versions prior to 1.20.0, update to version 1.20.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the API endpoints that allow the retrieval of LDAP credentials to minimize the risk of exploitation.

Exploit

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2018-19466

Produtos afetados

Portainer

Referências · 5

• 🔥 https://github.com/MauroEldritch/lempo · Exploit
• https://github.com/portainer/portainer/releases · Nota
• https://github.com/portainer/portainer/pull/2488 · Correção
• https://osv.dev/vulnerability/CVE-2018-19466 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-19466 · Nota de Segurança