CVE-2018-18926: Session Fixation

February 15, 2022 (updated April 12, 2022)

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.

References

github.com/advisories/GHSA-hf6f-jq25-8gq9
github.com/go-gitea/gitea/commit/aeb5655c25053bdcd7eee94ea37df88468374162
github.com/go-gitea/gitea/issues/5140
github.com/go-gitea/gitea/pull/5177
nvd.nist.gov/vuln/detail/CVE-2018-18926

Detect and mitigate CVE-2018-18926 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →