API Misconfiguration in Portainer Affecting User Administration

CVE-2018-19367

What is CVE-2018-19367?

Portainer, a popular container management tool, has a vulnerability in its API that allows attackers to exploit the user administration workflow. Specifically, through the API endpoint (/api/users/admin/check), it is possible to verify whether the admin user exists. If this user is not created, the endpoint will return a 404 status code. An attacker can use this information to set the admin password when the response indicates that the admin user is absent. This misconfiguration may lead to unauthorized access if an attacker takes advantage of this loophole, highlighting the importance of securing API endpoints and properly managing user permissions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References