CVE-2018-10813

In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on…

published June 5, 2018

CVSS
—
EPSS
1%
Percentile
65.8
In the wild
Unconfirmed
What it is

In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitHub. An attacker can edit the contents of the session cookie and re-sign it using the hardcoded secret. Due to the use of Passport.js, this could lead to privilege escalation.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01117 · 65.8th percentile
Published
2018-06-05T15:00Z
EPSS history
Timeline
  • 05 JUN 15:00Z
    In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on…
    cvelistv5