CVE-2018-1098CWE-352

A cross-site request forgery flaw was found in etcd 3.3.1 and earlier

published April 3, 2018

CVSS
—
EPSS
1%
Percentile
68.5
In the wild
Unconfirmed
What it is

A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server and modify a key. Adding a key is done with PUT so it is theoretically safe (can't PUT from an HTML form or such) but POST allows creating in-order keys that an attacker can send.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01223 · 68.5th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2018-04-03T16:00Z
EPSS history
Timeline
  • 03 APR 16:00Z
    A cross-site request forgery flaw was found in etcd 3.3.1 and earlier
    cvelistv5