Fluid Attacks Database

Description

The session cookie generated by the CUPS web interface was easy to guess on Linux, allowing unauthorized scripted access to the web interface when the web interface is enabled. This issue affected versions prior to v2.2.10.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 13	cups	>=0 <2.2.10-1	2.2.10-1
debian 14	cups	>=0 <2.2.10-1	2.2.10-1
debian 12	cups	>=0 <2.2.10-1	2.2.10-1
debian 11	cups	>=0 <2.2.10-1	2.2.10-1
rpm rhel6	cups	-	-
rpm rhel7	cups	<1:1.6.3-43.el7	1:1.6.3-43.el7
rpm rhel5	cups	-	-

Aliases

1. CVE-2018-43002. NVD-2018-43003. OSV-DEBIAN-2018-43004. OSV-2018-43005. SECURITY-TRACKER-CVE-2018-4300

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.