VULNERABILITY INTELLIGENCE

CVE-2018-1099

CVSS score5.5 MEDIUM
EPSS probability0.50%
CISA KEVNot currently listed
Published2018-04-03
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Description

DNS rebinding vulnerability found in etcd 3.3.1 and earlier. An attacker can control his DNS records to direct to localhost, and trick the browser into sending requests to localhost (or any other address).

Weakness classification

  • CWE-20: Improper Input Validation

Primary references