CVE-2018-18926: Code Injection

Q: What is CVE-2018-18926?

CVE-2018-18926 is a vulnerability in Gitea before version 1.5.4 that allows remote code execution due to improper validation of session IDs.

Q: What is the severity of CVE-2018-18926?

The severity of CVE-2018-18926 is critical, with a CVSS score of 9.8.

Q: How does CVE-2018-18926 impact Gitea?

CVE-2018-18926 allows attackers to remotely execute code in Gitea instances that are using versions prior to 1.5.4.

Q: How can I fix CVE-2018-18926?

To fix CVE-2018-18926, you should update Gitea to version 1.5.4 or later, which includes the necessary fixes for proper validation of session IDs.

Q: Where can I find more information about CVE-2018-18926?

You can find more information about CVE-2018-18926 in the NVD database and the GitHub issues and pull requests related to Gitea.

Published Nov 4, 2018

Updated

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.

Affected Software

2 affected componentsFixes available

go/code.gitea.io/gitea<1.5.2

1.5.2

Gitea Gitea<1.5.4

Remediation

Patch Available

https://github.com/go-gitea/gitea/issues/5140

Event History

Nov 4, 2018

CVE Published

05:29 AM

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

Description

Feb 15, 2022

Advisory Published

01:57 AM

Frequently Asked Questions

What is CVE-2018-18926?

CVE-2018-18926 is a vulnerability in Gitea before version 1.5.4 that allows remote code execution due to improper validation of session IDs.

What is the severity of CVE-2018-18926?