CVE-2018-5702

Name: CVE-2018-5702
Creator: NVD / NIST
Published: 2018-01-15T16:29:00.237+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 12.15%

Last modified Jun 17, 2026

CVE-2018-5702 is a vulnerability of currently unknown severity. Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack.. EPSS estimates a 12.15% chance of exploitation in the next 30 days.

Description

Transmission through 2.92 relies on X-Transmission-Session-Id (which is not a forbidden header for Fetch) for access control, which allows remote attackers to execute arbitrary RPC commands, and consequently write to arbitrary files, via POST requests to /transmission/rpc in conjunction with a DNS rebinding attack.

Metrics

EPSS Probability

12.15%

95.6th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Vendor	Product	Versions
Transmissionbt	Transmission	<= 2.92
Debian	Debian Linux	7.0
Debian	Debian Linux	8.0
Debian	Debian Linux	9.0

References

https://bugs.chromium.org/p/project-zero/issues/detail?id=1447Exploit, Issue Tracking, Technical Description, Third Party Advisory
https://github.com/transmission/transmission/pull/468Exploit, Technical Description, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/01/msg00020.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201806-07Third Party Advisory
https://twitter.com/taviso/status/951526615145566208Third Party Advisory
https://www.debian.org/security/2018/dsa-4087Third Party Advisory
https://www.exploit-db.com/exploits/43665/Exploit, Third Party Advisory, VDB Entry
https://bugs.chromium.org/p/project-zero/issues/detail?id=1447Exploit, Issue Tracking, Technical Description, Third Party Advisory
https://github.com/transmission/transmission/pull/468Exploit, Technical Description, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/01/msg00020.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201806-07Third Party Advisory
https://twitter.com/taviso/status/951526615145566208Third Party Advisory
https://www.debian.org/security/2018/dsa-4087Third Party Advisory
https://www.exploit-db.com/exploits/43665/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Jan 15, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2018-5702?

How severe is CVE-2018-5702?

Severity scoring for CVE-2018-5702 is pending analysis. The EPSS model estimates a 12.15% probability of exploitation in the next 30 days.

How do I fix CVE-2018-5702?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2018-5702?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST