CVE-2018-4300
cups: Session cookie generated by the CUPS web interface is easy to guess
Severity Score
5.9
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.
La cookie de sesión generada por la interfaz web de CUPS era fácil de adivinar en Linux, permitiendo un acceso de script no autorizado a la interfaz web cuando está deshabilitada. Este problema afectaba a las versiones anteriores a la v2.2.10.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2018-01-02 CVE Reserved
- 2018-08-14 CVE Published
- 2024-08-05 CVE Updated
- 2024-08-24 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-330: Use of Insufficiently Random Values
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/107785 | Third Party Advisory | |
| https://github.com/apple/cups/releases/tag/v2.2.10 | Release Notes | |
| https://lists.debian.org/debian-lts-announce/2019/09/msg00028.html | Mailing List |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2018-4300 | 2020-03-31 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1695929 | 2020-03-31 |