| Vulnerability Name: | CVE-2018-5702 (CCN-137526) | ||||||||||||||||||||||||||||||||||||
| Assigned: | 2017-11-29 | ||||||||||||||||||||||||||||||||||||
| Published: | 2017-11-29 | ||||||||||||||||||||||||||||||||||||
| Updated: | 2019-10-03 | ||||||||||||||||||||||||||||||||||||
| Summary: | Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack. | ||||||||||||||||||||||||||||||||||||
| CVSS v3 Severity: | 8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) 7.7 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
6.4 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C)
| ||||||||||||||||||||||||||||||||||||
| CVSS v2 Severity: | 6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
| ||||||||||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-noinfo | ||||||||||||||||||||||||||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2018-5702 Source: CCN Type: Google Security Research Issue 1447 transmission: rpc session-id mechanism design flaw Source: MISC Type: Exploit, Issue Tracking, Technical Description, Third Party Advisory https://bugs.chromium.org/p/project-zero/issues/detail?id=1447 Source: XF Type: UNKNOWN transmission-sessionid-cve20185702-cmd-exec(137526) Source: CCN Type: Transmission GIT Repository CVE-2018-5702: Mitigate dns rebinding attacks against daemon #468 Source: MISC Type: Exploit, Technical Description, Third Party Advisory https://github.com/transmission/transmission/pull/468 Source: MLIST Type: Mailing List, Third Party Advisory [debian-lts-announce] 20180118 [SECURITY] [DLA 1246-1] transmission security update Source: GENTOO Type: Third Party Advisory GLSA-201806-07 Source: MISC Type: Third Party Advisory https://twitter.com/taviso/status/951526615145566208 Source: DEBIAN Type: Third Party Advisory DSA-4087 Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [01-11-2018] Source: EXPLOIT-DB Type: Exploit, Third Party Advisory, VDB Entry 43665 | ||||||||||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration 2:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||||||||||