What’s Vulnerable › Vulnerabilities

CVE-2018-10813

• Severity: high (CVSS 7.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-06-05 · updated 2026-06-17
• Weakness: CWE-798

Description

In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitHub. An attacker can edit the contents of the session cookie and re-sign it using the hardcoded secret. Due to the use of Passport.js, this could lead to privilege escalation.

Affected products

• Aprendecondedos Dedos-Web: 1.0

References

• https://github.com/aprendecondedos/dedos-web/pull/1
• https://www.digitalinterruption.com/single-post/2018/06/04/Are-Your-Cookies-Telling-Your-Fortune
• https://github.com/aprendecondedos/dedos-web/pull/1
• https://www.digitalinterruption.com/single-post/2018/06/04/Are-Your-Cookies-Telling-Your-Fortune

Get alerted when CVE-2018-10813 or the next vulnerability affects your stack