CVEvulnerability
CVE-2018-19367
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2018-11-20
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
Description
Portainer through 1.19.2 provides an API endpoint (/api/users/admin/check) to verify that the admin user is already created. This API endpoint will return 404 if admin was not created and 204 if it was already created. Attackers can set an admin password in the 404 case.
Affected configurations
• portainer portainer (<= 1.19.2)
References
- https://github.com/lichti/shodan-portainer/ Exploit, Third Party Advisory
- https://github.com/portainer/portainer/issues/2475 Exploit, Issue Tracking, Mitigation, Third Party Advisory
- https://github.com/lichti/shodan-portainer/ Exploit, Third Party Advisory
- https://github.com/portainer/portainer/issues/2475 Exploit, Issue Tracking, Mitigation, Third Party Advisory