MEDIUMCVSS 5.3EPSS 1.3%

CVE-2024-29296

Portainer CE allows username enumeration through authentication response timing

Published: 2024-04-10
Modified: 2026-09-30
EPSS percentile: 68%
Aliases: GHSA-87x6-8m9v-g8c2
Sources: github-advisory

Summary

A user enumeration vulnerability was found in Portainer CE 2.19.4. This issue occurs during user authentication process, where a difference in response time could allow a remote unauthenticated user to determine if a username is valid or not.

Affected packages

Ecosystem	Package	Affected versions	Fixed versions
Go	github.com/portainer/portainer	—	0.6.1-0.20240417040827-48bc7d0d92f0

Remediation: Upgrade to 0.6.1-0.20240417040827-48bc7d0d92f0 or later.

References

https://github.com/advisories/GHSA-87x6-8m9v-g8c2

Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.

EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.