Vulnerability Description
Unauthenticated access to cloudtoken daemon on Linux via network from version 0.1.1 before version 0.1.24 allows attackers on the same subnet to gain temporary AWS credentials for the users' roles.
CVSS Score
6.1
MEDIUM
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Atlassian | Cloudtoken | >= 0.1.1, < 0.1.24 |
References
- https://bitbucket.org/atlassian/cloudtoken/wiki/CVE-2018-13390%20-%20Exposed%20cMitigationThird Party Advisory
- https://bitbucket.org/atlassian/cloudtoken/wiki/CVE-2018-13390%20-%20Exposed%20cMitigationThird Party Advisory
FAQ
What is CVE-2018-13390?
CVE-2018-13390 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Unauthenticated access to cloudtoken daemon on Linux via network from version 0.1.1 before version 0.1.24 allows attackers on the same subnet to gain temporary AWS credentials for the users' roles.
How severe is CVE-2018-13390?
CVE-2018-13390 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-13390?
Check the references section above for vendor advisories and patch information. Affected products include: Atlassian Cloudtoken.