CVE-2018-1098

2018-04-0316:00:00

CWE-352

redhat

www.cve.org

8.1 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

59.5%

JSON

A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server and modify a key. Adding a key is done with PUT so it is theoretically safe (can’t PUT from an HTML form or such) but POST allows creating in-order keys that an attacker can send.

CNA Affected

[
  {
    "product": "etcd",
    "vendor": "Red Hat, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "3.3.1 and earlier"
      }
    ]
  }
]