PT-2021-11022 · Portainer · Portainer

Published 2021-03-16 · Updated 2021-03-23 · CVE-2020-24263

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Portainer versions 1.24.1 and earlier

Description: The issue is related to insecure permissions, potentially leading to remote arbitrary code execution. A non-admin user can spawn new containers with critical capabilities, such as SYS MODULE, which can be used to take over the Docker host.

Recommendations: For Portainer versions 1.24.1 and earlier, consider restricting the capabilities assigned to non-admin users to prevent them from spawning containers with critical capabilities like SYS MODULE. As a temporary workaround, limit the access of non-admin users to the Docker host until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2020-24263

Affected Products

Portainer

References · 4

• https://osv.dev/vulnerability/CVE-2020-24263 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-24263 · Security Note
• https://github.com/portainer/portainer/issues/4105 · Note
• https://t.me/cibsecurity/24949 · Telegram Post