CVE-2018-5702 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2018-5702 Interim 1 7 2022-06-11T00:57:18Z current 2021-05-30T14:09:34Z 2022-06-11T00:57:18Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2018-5702 Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 15.0 openSUSE Leap 15.2 openSUSE Leap 15.3 openSUSE Leap 15.4 openSUSE Tumbleweed transmission-3.00-2.8 transmission-common-2.94-bp153.1.20 transmission-common-2.94-lp150.1.1 transmission-common-2.94-lp152.4.4 transmission-common-3.00-2.8 transmission-common-3.00-bp154.1.67 transmission-daemon-3.00-2.8 transmission-gtk-2.94-bp153.1.20 transmission-gtk-2.94-lp150.1.1 transmission-gtk-2.94-lp152.4.4 transmission-gtk-3.00-2.8 transmission-gtk-3.00-bp154.1.67 transmission-gtk-lang-2.94-bp153.1.20 transmission-gtk-lang-2.94-lp150.1.1 transmission-gtk-lang-2.94-lp152.4.4 transmission-gtk-lang-3.00-2.8 transmission-gtk-lang-3.00-bp154.1.67 transmission-qt-3.00-2.8 transmission-qt-lang-3.00-2.8 transmission-common-2.94-lp150.1.1 as a component of openSUSE Leap 15.0 transmission-gtk-2.94-lp150.1.1 as a component of openSUSE Leap 15.0 transmission-gtk-lang-2.94-lp150.1.1 as a component of openSUSE Leap 15.0 transmission-common-2.94-lp152.4.4 as a component of openSUSE Leap 15.2 transmission-gtk-2.94-lp152.4.4 as a component of openSUSE Leap 15.2 transmission-gtk-lang-2.94-lp152.4.4 as a component of openSUSE Leap 15.2 transmission-common-2.94-bp153.1.20 as a component of openSUSE Leap 15.3 transmission-gtk-2.94-bp153.1.20 as a component of openSUSE Leap 15.3 transmission-gtk-lang-2.94-bp153.1.20 as a component of openSUSE Leap 15.3 transmission-common-3.00-bp154.1.67 as a component of openSUSE Leap 15.4 transmission-gtk-3.00-bp154.1.67 as a component of openSUSE Leap 15.4 transmission-gtk-lang-3.00-bp154.1.67 as a component of openSUSE Leap 15.4 transmission-3.00-2.8 as a component of openSUSE Tumbleweed transmission-common-3.00-2.8 as a component of openSUSE Tumbleweed transmission-daemon-3.00-2.8 as a component of openSUSE Tumbleweed transmission-gtk-3.00-2.8 as a component of openSUSE Tumbleweed transmission-gtk-lang-3.00-2.8 as a component of openSUSE Tumbleweed transmission-qt-3.00-2.8 as a component of openSUSE Tumbleweed transmission-qt-lang-3.00-2.8 as a component of openSUSE Tumbleweed Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack. CVE-2018-5702 openSUSE Leap 15.0:transmission-common-2.94-lp150.1.1 openSUSE Leap 15.0:transmission-gtk-2.94-lp150.1.1 openSUSE Leap 15.0:transmission-gtk-lang-2.94-lp150.1.1 openSUSE Leap 15.2:transmission-common-2.94-lp152.4.4 openSUSE Leap 15.2:transmission-gtk-2.94-lp152.4.4 openSUSE Leap 15.2:transmission-gtk-lang-2.94-lp152.4.4 openSUSE Leap 15.3:transmission-common-2.94-bp153.1.20 openSUSE Leap 15.3:transmission-gtk-2.94-bp153.1.20 openSUSE Leap 15.3:transmission-gtk-lang-2.94-bp153.1.20 openSUSE Leap 15.4:transmission-common-3.00-bp154.1.67 openSUSE Leap 15.4:transmission-gtk-3.00-bp154.1.67 openSUSE Leap 15.4:transmission-gtk-lang-3.00-bp154.1.67 openSUSE Tumbleweed:transmission-3.00-2.8 openSUSE Tumbleweed:transmission-common-3.00-2.8 openSUSE Tumbleweed:transmission-daemon-3.00-2.8 openSUSE Tumbleweed:transmission-gtk-3.00-2.8 openSUSE Tumbleweed:transmission-gtk-lang-3.00-2.8 openSUSE Tumbleweed:transmission-qt-3.00-2.8 openSUSE Tumbleweed:transmission-qt-lang-3.00-2.8 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H