CVE-2018-5702: debian debian_linux
Vulnerability summary
CVE-2018-5702 is a high (CVSS 8.8) vulnerability in debian debian_linux. EPSS estimates a 11.93% chance of exploitation in the next 30 days, higher than 96.1% of scored vulnerabilities. 3 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 15-01-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
11.93%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
-0.18 pp
From 12.11% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundTransmission
Maturity: poc
Exploit Reference (bugs.chromium.org)
Maturity: unknown
Transmission - RPC DNS Rebinding
Maturity: weaponized
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Debian2 products
- transmission< 2.84-0.2+deb8u1 | < 2.92-2+deb9u1 | < 2.52-3+nmu3 | < 2.92-3
- debian_linuxEOL7.0 | 8.0 | 9.0
Mageia1 product
- transmission< 2.92-3.1.mga6
Transmissionbt1 product
- transmission≤ 2.92
Ubuntu1 product
- transmission< 2.82-1.1ubuntu3.2 | < 2.84-3ubuntu3.1
4 vendors · 5 products
References
14 links- bugs.chromium.org/p/project-zero/issues/detail?id=1447X Refsource MISCExploitIssue TrackingTechnical DescriptionThird Party AdvisoryREPORT
- github.com/transmission/transmission/pull/468X Refsource MISCExploitTechnical DescriptionThird Party AdvisoryREPORT
- lists.debian.org/debian-lts-announce/2018/01/msg00020.htmlMailing ListX Refsource MLISTThird Party Advisory