PT-2018-11792
CVE-2018-13390
·
Published
2018-08-10
·
Updated
2022-05-13
Description by
CVSS 3.1
6.1
MediumMetricsAV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
cloudtoken daemon versions 0.1.1 through 0.1.23
Description
The issue allows unauthenticated access to the cloudtoken daemon on Linux systems via the network, enabling attackers on the same subnet to obtain temporary AWS credentials for the users' roles.
Recommendations
For cloudtoken daemon versions 0.1.1 through 0.1.23, update to version 0.1.24 or later to resolve the issue.
Found an issue in the description? Have something to add? Feel free to write us 👾