{"id":"CVE-2018-5702","aliases":["DEBIAN-CVE-2018-5702","DLA-1246-1","DSA-4087-1","EUVD-2018-17471","GHSA-6q4w-fhcp-mhw6","MGASA-2018-0230","UBUNTU-CVE-2018-5702","USN-3533-1","openSUSE-SU-2024:11474-1"],"status":"published","title":"Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header...","description":"Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.11926,"percentile":0.96137,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"published":"2018-01-14T00:00:00Z","modified":"2026-10-23T18:03:07Z","exploits":[{"source":"exploitdb","id":"EDB-43665","title":"Transmission - RPC DNS Rebinding","type":"remote","platform":"multiple","date":"2018-01-11","verified":true,"url":"https://www.exploit-db.com/exploits/43665"}],"fixes":[{"ecosystem":"Debian:12","package":"transmission","fixed_in":["2.92-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"transmission","fixed_in":["2.92-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"transmission","fixed_in":["2.92-3"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"transmission","fixed_in":["2.52-3+nmu3"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"transmission","fixed_in":["2.84-0.2+deb8u1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"transmission","fixed_in":["2.92-2+deb9u1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"transmission","fixed_in":["2.92-3.1.mga6"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"transmission","fixed_in":["2.82-1.1ubuntu3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"transmission","fixed_in":["2.84-3ubuntu3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"transmission","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.92-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"transmission","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.92-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"transmission","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.92-3"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"transmission","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.52-3+nmu3"}]}],"versions":["2.52-3+nmu1","2.52-3+nmu2"]},{"source":"osv","ecosystem":"Debian:8","package":"transmission","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.84-0.2+deb8u1"}]}],"versions":["2.84-0.2"]},{"source":"osv","ecosystem":"Debian:9","package":"transmission","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.92-2+deb9u1"}]}],"versions":["2.92-2"]},{"source":"osv","ecosystem":"Mageia:6","package":"transmission","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.92-3.1.mga6"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"transmission","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.82-1.1ubuntu3.2"}]}],"versions":["2.82-0ubuntu1","2.82-1ubuntu1","2.82-1.1ubuntu1","2.82-1.1ubuntu3","2.82-1.1ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"transmission","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.84-3ubuntu3.1"}]}],"versions":["2.84-1ubuntu1","2.84-2","2.84-3","2.84-3ubuntu1","2.84-3ubuntu2","2.84-3ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"transmission","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.82-1.1ubuntu3.2"}]}],"versions":["2.82-0ubuntu1","2.82-1ubuntu1","2.82-1.1ubuntu1","2.82-1.1ubuntu3","2.82-1.1ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"transmission","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.84-3ubuntu3.1"}]}],"versions":["2.84-1ubuntu1","2.84-2","2.84-3","2.84-3ubuntu1","2.84-3ubuntu2","2.84-3ubuntu3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"transmission","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.00-2.8"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"transmissionbt","product":"transmission"}],"references":[{"url":"https://bugs.chromium.org/p/project-zero/issues/detail?id=1447","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Technical Description","Third Party Advisory","report"]},{"url":"https://www.exploit-db.com/exploits/43665/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://www.debian.org/security/2018/dsa-4087","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/transmission/transmission/pull/468","tags":["x_refsource_MISC","x_transferred","Exploit","Technical Description","Third Party Advisory","evidence","report"]},{"url":"https://security.gentoo.org/glsa/201806-07","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://twitter.com/taviso/status/951526615145566208","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/01/msg00020.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-5702"},{"url":"https://github.com/advisories/GHSA-6q4w-fhcp-mhw6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-5702","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0230.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22379","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-5702","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2018/01/12/1","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3533-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-5702","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-5702","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-5702","description":"Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack.","status":"published","published":"2018-01-15T16:00:00Z","modified":"2024-08-05T05:40:51.206Z","updated_at":"2026-11-02T14:35:01.28843Z"}],"euvd":[{"id":"EUVD-2018-17471","description":"Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack.","status":"published","published":"2018-01-15T16:00:00Z","modified":"2024-08-05T05:40:51Z","updated_at":"2026-11-03T02:40:10.116776Z"}],"ghsa":[{"id":"GHSA-6q4w-fhcp-mhw6","title":"Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header...","description":"Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack.","status":"published","published":"2022-05-13T01:52:54Z","modified":"2023-02-02T05:02:14Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:51:23.375018Z"}],"nvd":[{"id":"CVE-2018-5702","description":"Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack.","status":"published","published":"2018-01-15T16:29:00.237Z","modified":"2026-06-17T02:00:37.393Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:04:22.309028Z"}],"osv":[{"id":"CVE-2018-5702","description":"Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack.","status":"published","published":"2018-01-15T16:29:00.237Z","modified":"2026-10-20T10:50:27.501100692Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.442568Z"},{"id":"DEBIAN-CVE-2018-5702","description":"Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack.","status":"published","published":"2018-01-15T16:29:00.237Z","modified":"2026-10-23T18:03:07.201991474Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.867575Z"},{"id":"UBUNTU-CVE-2018-5702","description":"Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack.","status":"published","published":"2018-01-15T00:00:00Z","modified":"2026-02-04T04:34:59.438952Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:18.33562Z"},{"id":"DLA-1246-1","title":"transmission - security update","status":"published","published":"2018-01-18T00:00:00Z","modified":"2026-03-09T01:01:42.569052Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4087-1","title":"transmission - security update","status":"published","published":"2018-01-14T00:00:00Z","modified":"2026-03-09T01:19:36.197283Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2018-0230","title":"Updated transmission packages fix a security vulnerability","description":"Updated transmission packages fix security vulnerability:\n\nTavis Ormandy discovered a vulnerability in the Transmission BitTorrent client;\ninsecure RPC handling between the Transmission daemon and the client\ninterface(s) may result in the execution of arbitrary code if a user visits a\nmalicious website while Transmission is running (CVE-2018-5702).\n","status":"published","published":"2018-05-12T06:28:12Z","modified":"2026-04-16T06:23:09.064297768Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:11474-1","title":"transmission-3.00-2.8 on GA media","description":"These are all security issues fixed in the transmission-3.00-2.8 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:19:38.436678Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"USN-3533-1","title":"transmission vulnerability","description":"It was discovered that Transmission incorrectly handled certain POST requests to\nthe RPC server and allowed DNS rebinding attack. An attacker could possibly use this\nissue to execute arbitrary code.\n","status":"published","published":"2018-01-16T20:13:09Z","modified":"2026-02-10T04:41:16Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}