{"id":"CVE-2018-4300","aliases":["BELL-CVE-2018-4300","DEBIAN-CVE-2018-4300","DLA-1936-1","EUVD-2018-16086","GHSA-7w9x-rg6m-2fh9","RHSA-2020:1050","UBUNTU-CVE-2018-4300"],"status":"published","title":"The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing...","description":"The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01841,"percentile":0.79145,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2019-04-03T17:54:23Z","modified":"2026-10-23T18:04:47Z","fixes":[{"ecosystem":"Debian:12","package":"cups","fixed_in":["2.2.10-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cups","fixed_in":["2.2.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cups","fixed_in":["2.2.10-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"cups","fixed_in":["1.7.5-11+deb8u6"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"cups","fixed_in":["1.7.2-0ubuntu1.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"cups","fixed_in":["2.1.3-4ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"cups","fixed_in":["2.2.7-1ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.10-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.5-11+deb8u6"}]}],"versions":["1.7.5-11","1.7.5-11+deb8u1","1.7.5-11+deb8u2","1.7.5-11+deb8u3","1.7.5-11+deb8u4","1.7.5-11+deb8u5"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups-lpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"cups-ipptool","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.3-43.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-0ubuntu1.11"}]}],"versions":["1.7.0~rc1-0ubuntu5","1.7.0-0ubuntu2","1.7.0-0ubuntu3","1.7.0-1","1.7.0-2","1.7.1-1","1.7.1-2","1.7.1-2git1","1.7.1-3","1.7.1-4","1.7.1-4ubuntu1","1.7.1-5ubuntu1","1.7.1-5ubuntu3","1.7.1-5ubuntu4","1.7.1-5ubuntu5","1.7.1-5ubuntu6","1.7.1-5ubuntu7","1.7.1-5ubuntu8","1.7.1-5ubuntu9","1.7.1-5ubuntu10","1.7.2-0ubuntu1","1.7.2-0ubuntu1.1","1.7.2-0ubuntu1.2","1.7.2-0ubuntu1.4","1.7.2-0ubuntu1.5","1.7.2-0ubuntu1.6","1.7.2-0ubuntu1.7","1.7.2-0ubuntu1.8","1.7.2-0ubuntu1.9","1.7.2-0ubuntu1.10"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3-4ubuntu0.6"}]}],"versions":["2.1.0-4ubuntu3","2.1.0-5","2.1.0-6","2.1.0-6ubuntu1","2.1.0-7","2.1.2-1","2.1.2-2","2.1.3-1","2.1.3-1build1","2.1.3-3","2.1.3-4","2.1.3-4ubuntu0.2","2.1.3-4ubuntu0.3","2.1.3-4ubuntu0.4","2.1.3-4ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cups","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-1ubuntu2.2"}]}],"versions":["2.2.4-7ubuntu2","2.2.5-2","2.2.6-2","2.2.6-3","2.2.6-4","2.2.6-5","2.2.7-1ubuntu1","2.2.7-1ubuntu2","2.2.7-1ubuntu2.1"]}],"products":[{"vendor":"apple","product":"cups"},{"vendor":"openprinting","product":"cups"}],"references":[{"url":"https://github.com/apple/cups/releases/tag/v2.2.10","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/107785","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/09/msg00028.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-4300","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7w9x-rg6m-2fh9"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-4300","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-4300","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1050","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1607282","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1607291","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1649347","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1050.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-4180","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-4180","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-4180","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-4181","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-4181","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-4181","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-4300","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1695929","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-4300","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-4700","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-4700","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-4700","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-4300","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3842-1","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-4300","description":"The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.","status":"published","published":"2019-04-03T17:54:23Z","modified":"2024-08-05T05:11:22.271Z","updated_at":"2026-11-02T14:35:08.024147Z"}],"euvd":[{"id":"EUVD-2018-16086","description":"The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.","status":"published","published":"2019-04-03T17:54:23Z","modified":"2024-08-05T05:11:22Z","updated_at":"2026-11-03T02:40:13.563498Z"}],"ghsa":[{"id":"GHSA-7w9x-rg6m-2fh9","title":"The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing...","description":"The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.","status":"published","published":"2022-05-13T01:54:03Z","modified":"2023-02-02T05:02:16Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:51:23.915291Z"}],"nvd":[{"id":"CVE-2018-4300","description":"The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.","status":"published","published":"2019-04-03T18:29:06.017Z","modified":"2026-06-17T01:58:44.783Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:04:55.136632Z"}],"osv":[{"id":"BELL-CVE-2018-4300","title":"CVE-2018-4300 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T13:08:39.221547Z","modified":"2026-01-26T09:49:51.478031Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-4300","description":"The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.","status":"published","published":"2019-04-03T18:29:06.017Z","modified":"2026-10-20T10:50:32.587922984Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:09.442568Z"},{"id":"DEBIAN-CVE-2018-4300","description":"The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.","status":"published","published":"2019-04-03T18:29:06.017Z","modified":"2026-10-23T18:04:47.716744239Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:30.867575Z"},{"id":"RHSA-2020:1050","title":"Red Hat Security Advisory: cups security and bug fix update","status":"published","published":"2024-09-16T02:48:48Z","modified":"2026-06-26T12:21:10.232144711Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2018-4300","description":"The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.","status":"published","published":"2019-04-03T18:29:00Z","modified":"2026-04-22T11:55:53.219912Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:18.33562Z"},{"id":"DLA-1936-1","title":"cups - security update","status":"published","published":"2019-09-28T00:00:00Z","modified":"2026-03-09T01:19:35.587493Z","updated_at":"2026-11-02T15:46:10.227108Z"}]}}