CVE-2018-18926

Critical

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling…

mitre·CWE-384·Published 2018-11-04

CVSS

9.8

EPSS

0.03

KEV

Exploits

cve.orgen

181 chars

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.

NVDen

181 chars

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.

OSV.deven

56 chars

Gitea Remote Code Execution (RCE) in code.gitea.io/gitea

GHSAen

181 chars

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.

NVDes

231 chars

Gitea en versiones anteriores a la 1.5.4 permite la ejecución remota de código debido a que no valida correctamente los ID de sesión. Esto está relacionado con el manejo de ID de sesión en el código go-macaron/session para Macaron.

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	7.5	10.0	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P
3.0	Primary	NVD	9.8	3.9	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H