PT-2018-14726 · Go · Gitea

Published 2018-11-04 · Updated 2024-08-21 · CVE-2018-18926

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.5.4

Description The issue allows remote code execution due to improper validation of session IDs, specifically related to session ID handling in the go-macaron/session code for Macaron.

Recommendations For versions prior to 1.5.4, update to version 1.5.4 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation.

Fix

RCE

Code Injection

Session Fixation

Weakness Enumeration

CWE-94

CWE-384

Related Identifiers

CVE-2018-18926

GHSA-HF6F-JQ25-8GQ9

GO-2022-0844

Affected Products

Gitea

References · 11

• https://github.com/go-gitea/gitea/issues/5140 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-18926 · Security Note
• https://ubuntu.com/security/CVE-2018-18926 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hf6f-jq25-8gq9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-18926 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0844 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-18926 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-18926 · Security Note
• https://github.com/go-gitea/gitea/pull/5177 · Note
• https://github.com/go-gitea/gitea/commit/aeb5655c25053bdcd7eee94ea37df88468374162 · Note
• https://github.com/advisories/GHSA-hf6f-jq25-8gq9 · Note