PT-2018-1519 · Containous · Traefik

Juliens · Published 2018-08-20 · Updated 2024-08-20 · CVE-2018-15598

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Containous Traefik versions 1.6.x through 1.6.5

Description The issue is related to errors in the implementation of the API in the Containous Traefik reverse proxy server. If the --api option is used and authentication is missing, the configuration and secret may be exposed, especially if the API's port is publicly reachable. This could allow a remote attacker to disclose protected information.

Recommendations For Containous Traefik versions 1.6.x through 1.6.5, update to version 1.6.6 or later to resolve the issue. As a temporary workaround, consider disabling the --api option until a patch is available. Restrict access to the API's port to minimize the risk of exploitation. Ensure proper authentication is configured for the API to prevent unauthorized access.

Fix

Information Disclosure

Improper Authentication

Weakness Enumeration

CWE-200

CWE-287

Related Identifiers

BDU:2018-01074

CVE-2018-15598

GHSA-2CJC-RGMP-X649

GO-2023-1950

Affected Products

Traefik

References · 14

• https://osv.dev/vulnerability/CVE-2018-15598 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15598 · Security Note
• https://osv.dev/vulnerability/GHSA-2cjc-rgmp-x649 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-01074 · Security Note
• https://osv.dev/vulnerability/GO-2023-1950 · Vendor Advisory
• https://github.com/containous/traefik/commit/368bd170913078732bde58160f92f202f370278b · Note
• https://github.com/containous/traefik/commit/113250ce5735d554c502ca16fb03bb9119ca79f1 · Note
• https://github.com/containous/traefik/pull/3790/commits/368bd170913078732bde58160f92f202f370278b · Note
• https://github.com/containous/traefik/pull/3790/commits/113250ce5735d554c502ca16fb03bb9119ca79f1 · Note
• https://github.com/containous/traefik/releases/tag/v1.6.6 · Note
• https://github.com/containous/traefik/pull/3790 · Note
• https://github.com/containous/traefik · Note
• https://github.com/advisories/GHSA-2cjc-rgmp-x649 · Note
• https://vuldb.com/?id.123109 · Note