CVE-2019-12452 json
Containous Traefik Exposes Password Hashes
published 2019-05-29 7 y ago modified 2026-06-17 4 mo ago also GHSA-r3fq-cmmw-cpmm , GO-2023-1919 , EUVD-2022-5080
- cvss
- 7.5
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.5%
- EPSS 2.5% chance of exploitation in 30 days, percentile 85%
- public exploits
- 0
- none known
Summary
types/types.go in Containous Traefik 1.7.x through 1.7.11, when the --api flag is used and the API is publicly reachable and exposed without sufficient access control (which is contrary to the API documentation), allows remote authenticated users to discover password hashes by reading the Basic HTTP Authentication or Digest HTTP Authentication section, or discover a key by reading the ClientTLS section. These can be found in the JSON response to a /api request.
Patch / fix
- go github.com/traefik/traefik 1.7.12
- github.com/traefik/traefik@a169fec commit
- github.com/containous/traefik#4918 pull request
Exploit prediction
2.54% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/containous/traefik/pull/4918 referenced PoC, tagged "exploit" by a source, unverified
- github.com https://github.com/containous/traefik/issues/4917 referenced PoC, tagged "exploit" by a source, unverified
- docs.traefik.io https://docs.traefik.io/configuration/api/#security referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:P/I:N/A:N |
| GitHub | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/traefik/traefik | >=1.7.0, <1.7.12 |
1.7.12 |
Classification
- Weakness
-
- CWE-522 Insufficiently Protected Credentials
References
-
github.com
/containous/traefik/pull/4918
web, exploit, patch, third-party-advisory
-
github.com
/traefik/traefik/commit/a169fec2e08e391d24b509c00fcf011656c1395c
web, patch
-
github.com
/containous/traefik/issues/4917
web, exploit, third-party-advisory
-
docs.traefik.io
/configuration/api/#security
exploit, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2019-12452
advisory
-
github.com
/containous/traefik
package
-
github.com
/advisories/GHSA-r3fq-cmmw-cpmm
advisory
Sources
- CVE List CVE-2019-12452
- GitHub Advisory GHSA-r3fq-cmmw-cpmm
- NVD CVE-2019-12452
- OSV GO-2023-1919
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.