{"api_version":"1","generated_at":"2026-07-23T10:22:45+00:00","cve":"CVE-2018-10813","urls":{"html":"https://cve.report/CVE-2018-10813","api":"https://cve.report/api/cve/CVE-2018-10813.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-10813","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-10813"},"summary":{"title":"CVE-2018-10813","description":"In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitHub. An attacker can edit the contents of the session cookie and re-sign it using the hardcoded secret. Due to the use of Passport.js, this could lead to privilege escalation.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2018-06-05 15:29:00","updated_at":"2018-07-20 14:36:00"},"problem_types":["CWE-798"],"metrics":[],"references":[{"url":"https://github.com/aprendecondedos/dedos-web/pull/1","name":"https://github.com/aprendecondedos/dedos-web/pull/1","refsource":"MISC","tags":["Issue Tracking","Third Party Advisory"],"title":"Remove use of hard coded secrets by rastating · Pull Request #1 · aprendecondedos/dedos-web · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.digitalinterruption.com/single-post/2018/06/04/Are-Your-Cookies-Telling-Your-Fortune","name":"https://www.digitalinterruption.com/single-post/2018/06/04/Are-Your-Cookies-Telling-Your-Fortune","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"Continuous Cyber Security | UK | Digital Interruption","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-10813","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-10813","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"10813","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"aprendecondedos","cpe5":"dedos-web","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"10813","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"aprendecondedos","cpe5":"dedos-web","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2018-10813","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitHub. An attacker can edit the contents of the session cookie and re-sign it using the hardcoded secret. Due to the use of Passport.js, this could lead to privilege escalation."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://www.digitalinterruption.com/single-post/2018/06/04/Are-Your-Cookies-Telling-Your-Fortune","refsource":"MISC","url":"https://www.digitalinterruption.com/single-post/2018/06/04/Are-Your-Cookies-Telling-Your-Fortune"},{"name":"https://github.com/aprendecondedos/dedos-web/pull/1","refsource":"MISC","url":"https://github.com/aprendecondedos/dedos-web/pull/1"}]}},"nvd":{"publishedDate":"2018-06-05 15:29:00","lastModifiedDate":"2018-07-20 14:36:00","problem_types":["CWE-798"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"LOW","baseScore":7.3,"baseSeverity":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:aprendecondedos:dedos-web:1.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"10813","Ordinal":"127265","Title":"CVE-2018-10813","CVE":"CVE-2018-10813","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"10813","Ordinal":"1","NoteData":"In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitHub. An attacker can edit the contents of the session cookie and re-sign it using the hardcoded secret. Due to the use of Passport.js, this could lead to privilege escalation.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"10813","Ordinal":"2","NoteData":"2018-06-05","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"10813","Ordinal":"3","NoteData":"2018-06-05","Type":"Other","Title":"Modified"}]}}}