CVE-2018-13390: Medium severity atlassian cloudtoken vulnerability
Published Aug 10, 2018
·Updated
Unauthenticated access to cloudtoken daemon on Linux via network from version 0.1.1 before version 0.1.24 allows attackers on the same subnet to gain temporary AWS credentials for the users' roles.
Affected Software
2 affected componentsFixes available
Atlassian Cloudtoken>=0.1.1<0.1.24
pip/cloudtoken>=0.1.1<0.1.24
0.1.24
Event History
Aug 10, 2018
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
DescriptionWeakness
May 13, 2022
Advisory Published
via GitHub·01:49 AM
Frequently Asked Questions
1
What is the severity of CVE-2018-13390?
CVE-2018-13390 is classified as a high severity vulnerability due to the potential for unauthorized access to AWS credentials.
2
How do I fix CVE-2018-13390?
To fix CVE-2018-13390, upgrade the Cloudtoken package to version 0.1.24 or later.
3
Who is affected by CVE-2018-13390?
CVE-2018-13390 affects users running Cloudtoken versions from 0.1.1 before 0.1.24 on Linux.
4
What are the risks associated with CVE-2018-13390?
The risks of CVE-2018-13390 include potential unauthorized access to temporary AWS credentials, which could lead to data breaches.
5
Can CVE-2018-13390 be exploited remotely?
Yes, CVE-2018-13390 can be exploited remotely by attackers on the same subnet as the vulnerable Cloudtoken daemon.