CVE-2020-24263

Name of the Vulnerable Software and Affected Versions: Portainer versions 1.24.1 and earlier

Description: The issue is related to insecure permissions, potentially leading to remote arbitrary code execution. A non-admin user can spawn new containers with critical capabilities, such as SYS MODULE, which can be used to take over the Docker host.

Recommendations: For Portainer versions 1.24.1 and earlier, consider restricting the capabilities assigned to non-admin users to prevent them from spawning containers with critical capabilities like SYS MODULE. As a temporary workaround, limit the access of non-admin users to the Docker host until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.