CVE-2018-18926

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2018-11-04

Last modified

2024-08-05

Weaknesses

CWE-384

Affected products

• Gitea (Gitea)

References

• https://github.com/go-gitea/gitea/issues/5140