VULNERABILITY INTELLIGENCE

CVE-2018-10813

CVSS score7.3 HIGH

EPSS probability1.12%

CISA KEVNot currently listed

Published2018-06-05

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Description

In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitHub. An attacker can edit the contents of the session cookie and re-sign it using the hardcoded secret. Due to the use of Passport.js, this could lead to privilege escalation.

Weakness classification

CWE-798: Use of Hard-coded Credentials

Primary references

cve@mitre.org — Issue Tracking, Third Party Advisory
cve@mitre.org — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory