CVE-2018-18925

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/gogs/gogs/issues/5469	Patch Third Party Advisory
https://github.com/gogs/gogs/issues/5469	Patch Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*

History

21 Nov 2024, 03:56

Type	Values Removed	Values Added
References	~~() https://github.com/gogs/gogs/issues/5469 - Patch, Third Party Advisory~~	() https://github.com/gogs/gogs/issues/5469 - Patch, Third Party Advisory

Information

Published : 2018-11-04 05:29

Updated : 2024-11-21 03:56

NVD link : CVE-2018-18925

Mitre link : CVE-2018-18925

CVE.ORG link : CVE-2018-18925

JSON object : View

Products Affected

gogs

gogs

CWE

CWE-384

Session Fixation

{"id": "CVE-2018-18925", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2018-11-04T05:29:00.397", "references": [{"url": "https://github.com/gogs/gogs/issues/5469", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/gogs/gogs/issues/5469", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-384"}]}], "descriptions": [{"lang": "en", "value": "Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a \"..\" session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron."}, {"lang": "es", "value": "Gogs 0.11.66 permite la ejecuci\u00f3n remota de c\u00f3digo debido a que no valida correctamente los ID de sesi\u00f3n, tal y como queda demostrado por una falsificaci\u00f3n de archivos de sesi\u00f3n \"..\" en el proveedor de sesi\u00f3n de archivos en file.go. Esto est\u00e1 relacionado con el manejo de ID de sesi\u00f3n en el c\u00f3digo go-macaron/session para Macaron."}], "lastModified": "2024-11-21T03:56:53.020", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "19C82C8E-F556-4B88-BBC5-C2BB69C80723", "versionEndIncluding": "0.11.66"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}