Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2018-15598

Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable.

VectorNETWORK

PublishedAug 21, 2018, 01:29

Published Bycve@mitre.org

Base Score

Score7.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

github.com/traefik/traefik(Go)1.6.01.6.6N/A

References

https://github.com/containous/traefik/pull/3790
https://github.com/containous/traefik/pull/3790/commits/113250ce5735d554c502ca16fb03bb9119ca79f1
https://github.com/containous/traefik/pull/3790/commits/368bd170913078732bde58160f92f202f370278b
https://github.com/containous/traefik/releases/tag/v1.6.6

Weakness Type

CWE-287

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Base SeverityHigh

Version

3.0

Attack Vector (AV)

NETWORK