CVE-2018-1000858

HIGH

GnuPG 2.1.12-2.2.11 - Cross-Site Request Forgery via WKD Request

Title source: llm
STIX 2.1

Description

GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been fixed in after commit 4a4bb874f63741026bd26264c43bb32b1099f060.

References (3)

Core 3
Core References
Third Party Advisory x_refsource_misc
https://sektioneins.de/en/blog/18-11-23-gnupg-wkd.html
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/3853-1/
Exploit, Third Party Advisory x_refsource_misc
https://sektioneins.de/en/advisories/advisory-012018-gnupg-wkd.html

Scores

CVSS v3 8.8
EPSS 0.0020
EPSS Percentile 42.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-352
Status published
Products (3)
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 18.10
gnupg/gnupg 2.1.12 - 2.2.11
Published Dec 20, 2018
Tracked Since Feb 18, 2026