critical9.8
CVE-2018-18926
Gitea Remote Code Execution (RCE)
Impact
Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | code.gitea.io/gitea | < 1.5.2 | 1.5.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gitea | Gitea | before 1.5.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/go-gitea/gitea/issues/5140
- https://github.com/advisories/GHSA-hf6f-jq25-8gq9
- https://nvd.nist.gov/vuln/detail/CVE-2018-18926
- https://github.com/go-gitea/gitea/pull/5177
- https://github.com/go-gitea/gitea/commit/aeb5655c25053bdcd7eee94ea37df88468374162