Vulnerability · Published Apr 10, 2024 · Assigned by mitre
CVE-2024-29296
Medium 5.3
In plain English
A medium-severity security flaw in the github.com/portainer/portainer package (Go). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/portainer/portainer | 0.6.1-0.20240417040827-48bc7d0d92f0 | GHSA-87x6-8m9v-g8c2 |
| Go | github.com/portainer/portainer | 0.6.1-0.20240417040827-48bc7d0d92f0 | GO-2026-6619 |
Affected products (as reported)
Weakness: CWE-286 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N