CVE-2018-19466 - A vulnerability was found in Portainer before 1.20.0

Back Back to CVE browser

CRITICAL

A vulnerability was found in Portainer before 1.20.0

Published Mar 27, 2019

9.8

CRITICAL

CVSS 3.0

EPSS 3.72%

Description

A vulnerability was found in Portainer before 1.20.0. Portainer stores LDAP credentials, corresponding to a master password, in cleartext and allows their retrieval via API calls.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-522

Insufficiently Protected Credentials

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-11155
Advisory
https://github.com/MauroEldritch/lempo
x_refsource_MISCExploitPatchThird Party Advisory
https://github.com/portainer/portainer/pull/2488
x_refsource_MISCPatchThird Party Advisory
https://github.com/portainer/portainer/releases
x_refsource_MISCRelease NotesThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-11155		Advisory
https://github.com/MauroEldritch/lempo		x_refsource_MISCExploitPatchThird Party Advisory
https://github.com/portainer/portainer/pull/2488		x_refsource_MISCPatchThird Party Advisory
https://github.com/portainer/portainer/releases		x_refsource_MISCRelease NotesThird Party Advisory