$ cve CVE-2018-10933 JSON

CVE-2018-10933 EXPLOIT

9.1

CRITICAL · CVSS 3.0 · EPSS 91.8% (pctl 100)

Patch early

A public exploit exists.

Description

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

Scoring

CVSS	9.1 (CRITICAL, v3.0)
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS	91.79% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-592
On CISA KEV	no
Public exploit	yes
Published	2018-10-17
Last modified	2026-06-17

Affected (9)

Vendor	Product
canonical	ubuntu linux
debian	debian linux
libssh	libssh
netapp	oncommand unified manager
netapp	oncommand workflow automation
netapp	snapcenter
netapp	storage automation store
oracle	mysql workbench
redhat	enterprise linux

Public exploits

Source	Title	Date
exploit-db	LibSSH 0.7.6 / 0.8.4 - Unauthorized Access	2018-10-20
exploit-db	libSSH - Authentication Bypass	2018-10-18

References

→ the Explorer · watch your stack · NVD