Orta CVSS 5.4
CVE-2026-39848: Dockyard: kritik işlevde kimlik doğrulaması eksik
Açıklama (NVD)
Dockyard is a Docker container management app. Prior to 1.1.0, Docker container start and stop operations are performed through GET requests without CSRF protection. A remote attacker can cause a logged-in administrator's browser to request /apps/action.php?action=stop&name=<container> or /apps/action.php?action=start&name=<container>, which starts or stops the target container. This vulnerability is fixed in 1.1.0.
Özet bilgiler
- Ürün
- 10ij Dockyard
- CVSS v3.1
- 5.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L - EPSS
- %0,11 (yüzdelik 1)
- CWE
- CWE-306
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| 10ij-dockyard | — | — | 1.1.0 |