What is CVE-2018-10813?

CVE-2018-10813 is a high-severity vulnerability in Aprendecondedos Dedos-Web, classified under Use of Hard-coded Credentials. CVSS score: 7.3/10. Published 2018-06-05.

How severe is CVE-2018-10813?

High severity. CVSS v3 base score is 7.3 out of 10.

Vulnerability in Aprendecondedos Dedos-Web

CVE-2018-10813

In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitHub. An attacker can edit the contents of the session cookie and re-sign it using the hardcoded secret. Due to the use of Passport.js, this could lead to privilege escalation.

EPSS: 0.011 (63.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.

Affected products

Aprendecondedos Dedos-web — versions 1.0
N/a — versions n/a

Weakness classification (CWE)

CWE-798 — Use of Hard-coded Credentials

References

cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (Third Party Advisory, x_refsource_MISC, Issue Tracking)

Frequently asked questions

What is CVE-2018-10813?: CVE-2018-10813 is a high-severity vulnerability in Aprendecondedos Dedos-Web, classified under Use of Hard-coded Credentials. CVSS score: 7.3/10. Published 2018-06-05.
How severe is CVE-2018-10813?: High severity. CVSS v3 base score is 7.3 out of 10.