Description
A vulnerability was found in Portainer before 1.20.0. Portainer stores LDAP credentials, corresponding to a master password, in cleartext and allows their retrieval via API calls.
Exploits (1)
References (3)
Core 3
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/portainer/portainer/pull/2488
Release Notes, Third Party Advisory x_refsource_misc
https://github.com/portainer/portainer/releases
Exploit, Patch, Third Party Advisory x_refsource_misc
https://github.com/MauroEldritch/lempo
Scores
CVSS v3
9.8
EPSS
0.1278
EPSS Percentile
94.0%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-522
Status
published
Products (1)
portainer/portainer
< 1.20.0
Published
Mar 27, 2019
Tracked Since
Feb 18, 2026