Portainer before 1.22.1 has Incorrect Access Control (issue 4 of 4).

Portainer before 1.22.1 allows Directory Traversal.

Portainer before 1.22.1 has Incorrect Access Control (issue 2 of 4).

Portainer before 1.22.1 has XSS (issue 1 of 2).

Portainer before 1.22.1 has Incorrect Access Control (issue 1 of 4).

A vulnerability was found in Portainer before 1.20.0. Portainer stores LDAP credentials, corresponding to a master password, in cleartext and allows their retrieval via API calls.

Portainer through 1.19.2 provides an API endpoint (/api/users/admin/check) to verify that the admin user is already created. This API endpoint will return 404 if admin was not created and 204 if it was already created. Attackers can set an admin password in the 404 case.

A stored Cross-site scripting (XSS) vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field.

Portainer before 1.18.0 supports unauthenticated requests to the websocket endpoint with an unvalidated id query parameter for the /websocket/exec endpoint, which allows remote attackers to bypass intended access restrictions or conduct SSRF attacks.