CVE-2024-29296
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk66th percentile - higher than 66% of all known CVEs
Summary
A user enumeration vulnerability was found in Portainer CE 2.19.4. During the authentication process, a difference in response time allows a remote unauthenticated attacker to determine if a username is valid.
Risk Assessment
The risk is that an attacker can compile a list of valid usernames, facilitating targeted brute-force or social engineering attacks against the Portainer system.
Recommendation
It is recommended to upgrade Portainer CE to the latest available version that fixes this vulnerability. Until then, consider restricting access to the Portainer interface to trusted networks only.
Original NVD description (English source)
A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.