CVSS 3.0
9.1 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NCVE-2018-10933
A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.
Severity
- EPSS
- 92% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-287, CWE-592
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- debian:debian_linux
- libssh:libssh
- netapp:oncommand_unified_manager
- netapp:oncommand_workflow_automation
- netapp:snapcenter
- netapp:storage_automation_store
- oracle:mysql_workbench
- redhat:enterprise_linux