PT-2018-3598 · Apple+3 · Cups+3
Publicado
2018-12-07
·
Atualizado
2020-04-08
·
CVE-2018-4300
CVSS v2.0
7.1
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
CUPS versions prior to 2.2.10
Description
The issue is related to the CUPS web interface, where the session cookie is easily guessable on Linux systems, allowing unauthorized scripted access when the web interface is enabled. This is due to a lack of protection for service data, which can be exploited by a remote attacker to gain unauthorized access to protected information.
Recommendations
For versions prior to 2.2.10, update to version 2.2.10 or later to resolve the issue. As a temporary workaround, consider disabling the CUPS web interface until a patch is available. Restrict access to the CUPS web interface to minimize the risk of exploitation.
Correção
Information Disclosure
Use of Insufficiently Random Values
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Cups
Centos
Red Hat