CVE-2018-1098: CSRF
A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server and modify a key. Adding a key is done with PUT so it is theoretically safe (can't PUT from an HTML form or such) but POST allows creating in-order keys that an attacker can send.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1098?
CVE-2018-1098 is classified as a high severity cross-site request forgery vulnerability.
How do I fix CVE-2018-1098?
To remediate CVE-2018-1098, upgrade etcd to version 3.4.0 or later.
What versions of etcd are affected by CVE-2018-1098?
CVE-2018-1098 affects etcd versions 3.3.1 and earlier.
What type of vulnerability is CVE-2018-1098?
CVE-2018-1098 is a cross-site request forgery flaw that allows attackers to send unauthorized requests.
Can CVE-2018-1098 be exploited remotely?
Yes, an attacker can exploit CVE-2018-1098 remotely by creating a malicious website to send POST requests to the etcd server.