Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2018-5702

Опубликовано: 15 янв. 2018
Источник: nvd
CVSS3: 8.8
CVSS2: 6.8
EPSS Средний

Описание

Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack.

Ссылки

Уязвимые конфигурации

Конфигурация 1
cpe:2.3:a:transmissionbt:transmission:*:*:*:*:*:*:*:*
Версия до 2.92 (включая)
Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 96%
0.27224
Средний

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

ubuntu логотип

CVE-2018-5702

CVSS3: 8.8
ubuntu
около 8 лет назад

Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack.

debian логотип

CVE-2018-5702

CVSS3: 8.8
debian
около 8 лет назад

Transmission through 2.92 relies on X-Transmission-Session-Id (which i ...

github логотип

GHSA-6q4w-fhcp-mhw6

CVSS3: 8.8
github
больше 3 лет назад

Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack.

EPSS

Процентиль: 96%
0.27224
Средний

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

NVD-CWE-noinfo