CVE-2018-12678

Name of the Vulnerable Software and Affected Versions Portainer versions prior to 1.18.0

Description The issue allows remote attackers to bypass intended access restrictions or conduct SSRF attacks due to unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the "/websocket/exec" endpoint.

Recommendations For versions prior to 1.18.0, update to version 1.18.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/websocket/exec" endpoint until a patch is available. Avoid using the id query parameter in the affected endpoint until the issue is resolved.