Original description
Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable.
Affected software
- Traefik ≥ 1.6.0 < 1.6.6 Fixed in: 1.6.6 exact match
Details
- Published
- 2018-08-21
- Last modified
- 2024-08-05
- CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- cve.org/CVE-2018-15598
- nvd.nist.gov/vuln/detail/CVE-2018-15598
- github.com/containous/traefik/pull/3790
- github.com/containous/traefik/pull/3790/commits/368bd170913078732bde58160f92f202f370278b
- github.com/containous/traefik/releases/tag/v1.6.6
- github.com/containous/traefik/pull/3790/commits/113250ce5735d554c502ca16fb03bb9119ca79f1
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
This product uses data from the NVD API but is not endorsed or certified by the NVD. CVE® is a registered trademark of The MITRE Corporation; CVE records are used under the CVE Program Terms of Use.