CVE-2018-15598 — Improper Authentication in Traefik Traefik

CWE-287 — Improper Authentication5 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.4%
top 41.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Github.com Traefik TraefikTraefik
Timeline
PublishedAug 21
Latest updateAug 20

Description

Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDtraefik/traefik1.6.0 — 1.6.6
▶Gogithub.com/traefik_traefik1.6.0 — 1.6.6

🔴Vulnerability Details

4
OSV
Traefik Missing Authentication in github.com/traefik/traefik↗2024-08-20
▶
GHSA
Traefik Missing Authentication↗2022-05-13
▶
OSV
Traefik Missing Authentication↗2022-05-13
▶
CVEList
CVE-2018-15598: Containous Traefik 1↗2018-08-21
▶
CVE-2018-15598 — Improper Authentication | cvebase