CVE-2018-1098 - AskarLabs CVE Database

CVE-2018-1098

Vendor Red Hat, Inc.

Product etcd

Weakness CWE-352 · CSRF

Published April 3, 2018

Last update August 5, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

A cross-site request forgery flaw was found in etcd 3.3.1 and earlier. An attacker can set up a website that tries to send a POST request to the etcd server and modify a key. Adding a key is done with PUT so it is theoretically safe (can't PUT from an HTML form or such) but POST allows creating in-order keys that an attacker can send.

Key dates

02Disclosure timeline

April 3, 2018 CVE published

August 5, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2018-1098 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html

Related vulnerabilities

04Related CVE

CVE-2025-23820 WordPress Content Security Policy Pro plugin <= 1.3.5 - CSRF to Stored XSS vulnerability CVE-2024-31374 WordPress AppPresser plugin <= 4.3.0 - Cross Site Request Forgery (CSRF) vulnerability CVE-2023-22700 WordPress PixelYourSite – Your smart PIXEL (TAG) Manager Plugin <= 9.3.0 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2022-3274 Cross-Site Request Forgery (CSRF) on user's settings in GitHub repository ikus060/rdiffweb prior to 2.4.6. in ikus060/rdiffweb CVE-2025-62687