Insecure Permissions Vulnerability in Portainer by Portainer
CVE-2020-24263

8.8HIGH

Key Information:

Vendor

Portainer

Status
Portainer
Vendor
CVE Published:
16 March 2021

What is CVE-2020-24263?

Portainer versions prior to 1.24.1 are susceptible to an insecure permissions vulnerability that allows non-administrative users to create containers with hazardous capabilities, such as SYS_MODULE. This flaw can potentially enable attackers to gain control over the Docker host, leading to significant security risks. It is crucial for users to upgrade to the latest version to mitigate this threat.

References

https://github.com/portainer/portainer/issues/4105
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.