Security Advisory

CVE-2018-10813

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2018-06-05 15:00:00

Last updated 2024-08-05 07:46:47

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitHub. An attacker can edit the contents of the session cookie and re-sign it using the hardcoded secret. Due to the use of Passport.js, this could lead to privilege escalation.

← Browse all CVEs View on cve.org ↗