CVE-2018-4300 Information disclosure in CUPS

What is CVE-2018-4300?

CVE-2018-4300 is a medium-severity vulnerability in Apple Cups, published on 3 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.

Weakness: CWE-200

Which versions are affected by CVE-2018-4300?

It affects 1 product.

Products include Apple Cups.

How do I fix CVE-2018-4300?

Upgrade to a fixed version.

Is CVE-2018-4300 being exploited?

There is no known exploitation of CVE-2018-4300 in the wild and no public exploit code.

Other vulnerabilities in Apple Cups

• CVE-2008-5184 Cross-site request forgery in n/a Critical 10.0
• CVE-2008-3641 Memory corruption in n/a Critical 10.0
• CVE-2008-0053 Memory corruption in n/a Critical 10.0
• CVE-2012-6094 Missing authorization in cups Critical 9.8
• CVE-2010-2941 Use after free in n/a Critical 9.8

All Apple Cups vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CVE-2018-4700, DEBIAN-CVE-2018-4300, DLA-1936-1, GHSA-7w9x-rg6m-2fh9.