high8.8
CVE-2020-24263
Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead to remote arbitrary code execution.
Impact
Portainer 1.24.1 and earlier is affected by an insecure permissions vulnerability that may lead to remote arbitrary code execution. A non-admin user is allowed to spawn new containers with critical capabilities such as SYS_MODULE, which can be used to take over the Docker host.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Portainer | Portainer | through 1.24.1 |