CVE-2018-12678

—

CVSS 3.0

9.8 critical

EPSS

2%p82

Published

Jun 22, 2018 (Jun 22, 2018)

Modified

Jun 17, 2026

Description

Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocket/exec endpoint, which allows remote attackers to bypass intended access restrictions or conduct SSRF attacks.

Vendors: portainer
Products: portainer
Weakness: CWE-918
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.3%)

In the news0 stories

No ingested article mentions this CVE yet.