CVE-2018-18926: Session Fixation

November 4, 2018 (updated January 29, 2019)

Gitea allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.

References

nvd.nist.gov/vuln/detail/CVE-2018-18926

Detect and mitigate CVE-2018-18926 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →