CVE-2020-24264 - CVE House
Back to Database
Status published Critical CVE-2020-24264

Portainer 1.24.1 and earlier is affected by incorrect access control...

Vulnerability Description

Portainer 1.24.1 and earlier is affected by incorrect access control that may lead to remote arbitrary code execution. The restriction checks for bind mounts are applied only on the client-side and not the server-side, which can lead to spawning a container with bind mount. Once such a container is spawned, it can be leveraged to break out of the container leading to complete Docker host machine takeover.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-24264

Credits & Attribution

No credits recorded in the NVD database.

References

More from portainer

View All →
CVE-2025-49593
Portainer HTTP Headers May Leak to Malicious Container Registries
Medium 6.8
CVE-2022-24961
In Portainer Agent before 2.11.1, an API server can continue...
Critical 9.8
CVE-2021-42650
Cross Site Scripting (XSS vulnerability exists in Portainer before 2.9.1...
Medium 6.1
CVE-2020-24263
Portainer 1.24.1 and earlier is affected by an insecure permissions...
High 8.8
CVE-2019-16878
Portainer before 1.22.1 has XSS (issue 2 of 2)....
Medium 5.4

Affected Vendor

Affected Software

portainer
Vulnerable Versions:
0

Timeline

Official Publish: March 16th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.