CVE-2018-4300

Published: 03 April 2019

The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.

Priority

Medium

CVSS 3 base score: 5.9

Status

Package Release Status
cups
Launchpad, Ubuntu, Debian
Upstream
Released (2.2.10-1)
Ubuntu 20.04 LTS (Focal Fossa) Not vulnerable
(2.3.1-9ubuntu1.1)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (2.2.7-1ubuntu2.2)
Ubuntu 16.04 ESM (Xenial Xerus)
Released (2.1.3-4ubuntu0.6)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist

Patches:
Upstream: https://github.com/apple/cups/commit/feb4c62b211bfbd78dc10d737d873439ccdfa58c (2.2.10)
Upstream: https://github.com/apple/cups/commit/b9ff93ce913ff633a3f667317e5a81fa7fe0d5d3 (2.3b6)

Notes

AuthorNote
mdeslaur
Updates for this issue were originally assigned CVE-2018-4700,
which was a typo and got rejected.

References

Bugs