Vulnerability Description
The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.
CVSS Score
5.9
MEDIUM
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apple | Cups | < 2.2.10 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/107785Third Party Advisory
- https://github.com/apple/cups/releases/tag/v2.2.10Release NotesThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/09/msg00028.html
- http://www.securityfocus.com/bid/107785Third Party Advisory
- https://github.com/apple/cups/releases/tag/v2.2.10Release NotesThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/09/msg00028.html
FAQ
What is CVE-2018-4300?
CVE-2018-4300 is a vulnerability with a CVSS score of 5.9 (MEDIUM). The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected ver...
How severe is CVE-2018-4300?
CVE-2018-4300 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-4300?
Check the references section above for vendor advisories and patch information. Affected products include: Apple Cups.