CVE-2020-24264

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-24264
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-24264.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-24264
Published
2021-03-16T15:15:12.607Z
Modified
2026-08-07T14:53:16.866736Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution. The restriction checks for bind mounts are applied only on the client-side and not the server-side, which can lead to spawning a container with bind mount. Once such a container is spawned, it can be leveraged to break out of the container leading to complete Docker host machine takeover.

References

Affected packages

Git / github.com/portainer/portainer

Affected ranges

Type
GIT
Repo
https://github.com/portainer/portainer
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f347d97dafa2563d04cec02e33db173cc1eee392
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:portainer:portainer:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.24.1"
        }
    ]
}

Affected versions

1.*
1.11.3
1.20.0
1.20.1
1.20.2
1.21.0
1.22.0
1.22.1
1.23.0
1.23.1
1.23.2
1.24.0
1.24.1
internal-1.*
internal-1.2.0
internal-1.3.0
internal-1.4.0
internal-1.5.0
internal-1.6.0
v0.*
v0.5
v0.6.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-24264.json"