CVE-2018-8040

Pages that are rendered using the ESI plugin can have access to the cookie header when the plugin is configured not to allow access. This affects Apache Traffic Server (ATS) versions 6.0.0 to 6.2.2 and 7.0.0 to 7.1.3. To resolve this issue users running 6.x should upgrade to 6.2.3 or later versions and 7.x users should upgrade to 7.1.4 or later versions.

• CWE-668

• http://www.securityfocus.com/bid/105181Third Party Advisory, VDB Entry
• https://github.com/apache/trafficserver/pull/3926Patch, Third Party Advisory
• https://lists.apache.org/thread.html/36b3df68fe7311965f6bc4630ca413d2aa99d8f1d53affda85ea70d7%40%3Cusers.trafficserver.apache.org%3E
• https://lists.apache.org/thread.html/cc7aa2ce1c6f4fe0c6bfef517763cdaad30ec7bcb0115b73f73f3c01%40%3Cusers.trafficserver.apache.org%3E
• https://www.debian.org/security/2018/dsa-4282Third Party Advisory
• http://www.securityfocus.com/bid/105181Third Party Advisory, VDB Entry
• https://github.com/apache/trafficserver/pull/3926Patch, Third Party Advisory
• https://lists.apache.org/thread.html/36b3df68fe7311965f6bc4630ca413d2aa99d8f1d53affda85ea70d7%40%3Cusers.trafficserver.apache.org%3E
• https://lists.apache.org/thread.html/cc7aa2ce1c6f4fe0c6bfef517763cdaad30ec7bcb0115b73f73f3c01%40%3Cusers.trafficserver.apache.org%3E
• https://www.debian.org/security/2018/dsa-4282Third Party Advisory

Published

Aug 29, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-8034The host name verification when using TLS with the WebSocket…7.5
• CVE-2018-8035This vulnerability relates to the user's browser processing …
• CVE-2018-8036In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a c…
• CVE-2018-8037If an async request was completed by the application at the …
• CVE-2018-8038Versions of Apache CXF Fediz prior to 1.4.4 do not fully dis…
• CVE-2018-8039It is possible to configure Apache CXF to use the com.sun.ne…
• CVE-2018-8041Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.…
• CVE-2018-8042Apache Ambari, version 2.5.0 to 2.6.2, passwords for Hadoop …
• CVE-2018-8043The unimac_mdio_probe function in drivers/net/phy/mdio-bcm-u…
• CVE-2018-8044K7Computing Pvt Ltd K7Antivirus Premium 15.1.0.53 is affecte…7.8
• CVE-2018-8045In Joomla! 3.5.0 through 3.8.5, the lack of type casting of …
• CVE-2018-8046The getTip() method of Action Columns of Sencha Ext JS 4 to …