CVE-2018-1098

HIGH8.8EPSS 0.26%

etcd Cross-site Request Forgery (CSRF)

發布日:2022/2/15修改日:2023/11/8
也稱為:GHSA-5gjm-fj42-x983DEBIAN-CVE-2018-1098

描述

A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server and modify a key. Adding a key is done with PUT so it is theoretically safe (can't PUT from an HTML form or such) but POST allows creating in-order keys that an attacker can send.

受影響套件(2)

CVSS 分數

來源版本嚴重程度向量
osvCVSS 3.1HIGH8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

參考連結(9)