CVE-2018-1000883

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-12-20 · updated 2026-06-17
Weakness: CWE-20

Description

Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that can result in Given a cookie value, Headers can be added. This attack appear to be exploitable via Crafting a value to be sent as a cookie. This vulnerability appears to have been fixed in >= 1.3.5 or ~> 1.2.5 or ~> 1.1.9 or ~> 1.0.6.

Affected products

Plug Project Plug: from 1.0.6 (excl.) through 1.1.9; from 1.1.9 (excl.) through 1.2.5; from 1.2.5 before 1.3.5; from 1.3.5 — fixed in 1.3.5

How to fix

Upgrade to a fixed version: Plug Project Plug 1.3.5. Check the vendor advisory for mitigations.

References

https://github.com/dependabot/elixir-security-advisories/blob/master/packages/plug/2017-04-17.yml
https://github.com/elixir-plug/plug/commit/8857f8ab4acf9b9c22e80480dae2636692f5f573
https://github.com/dependabot/elixir-security-advisories/blob/master/packages/plug/2017-04-17.yml
https://github.com/elixir-plug/plug/commit/8857f8ab4acf9b9c22e80480dae2636692f5f573

Get alerted when CVE-2018-1000883 or the next vulnerability affects your stack