CVE-2018-11757 is a critical vulnerability affecting Apache OpenWhisk, specifically Docker actions inheriting the openwhisk/dockerskeleton:1.3.0 (or earlier) Docker tag. It allows an unauthenticated attacker to replace the user function within a container if the user's code is already vulnerable to exploitation. With a CVSS score of 9.8 (Critical), this vulnerability has a low attack complexity and can lead to complete compromise of confidentiality, integrity, and availability. While there is no known public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has received some community discussion and media coverage, indicating awareness of its potential impact.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.3.0CPE matchmatch criteria | cpe:2.3:a:apache:openwhisk:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.