Portainer: >> Portainer Security Vulnerabilities
Portainer before 1.22.1 has Incorrect Access Control (issue 2 of 4).
CVSS Score
6.5
EPSS Score
0.004
Published
2019-11-07
A vulnerability was found in Portainer before 1.20.0. Portainer stores LDAP credentials, corresponding to a master password, in cleartext and allows their retrieval via API calls.
CVSS Score
9.8
EPSS Score
0.121
Published
2019-03-27
Portainer through 1.19.2 provides an API endpoint (/api/users/admin/check) to verify that the admin user is already created. This API endpoint will return 404 if admin was not created and 204 if it was already created. Attackers can set an admin password in the 404 case.
CVSS Score
9.8
EPSS Score
0.003
Published
2018-11-20
A stored Cross-site scripting (XSS) vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field.
CVSS Score
5.4
EPSS Score
0.002
Published
2018-09-01
Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocket/exec endpoint, which allows remote attackers to bypass intended access restrictions or conduct SSRF attacks.
CVSS Score
9.8
EPSS Score
0.004
Published
2018-06-22
Page 2