Cross-Site Request Forgery Vulnerability in GnuPG dirmngr Product by GnuPG
CVE-2018-1000858

8.8HIGH

Key Information:

Vendor: Gnupg
Status: Gnupg
Vendor: CVE Published:; 20 December 2018

What is CVE-2018-1000858?

The GnuPG software versions 2.1.12 to 2.2.11 showcase a Cross-Site Request Forgery (CSRF) vulnerability within the dirmngr component. This vulnerability may allow attackers to control CSRF, potentially leading to unauthorized information disclosure and denial of service (DoS) conditions. Users could be exploited if they perform a WKD request—such as entering an email address in the Thunderbird/Enigmail composer window—while targeted by a malicious entity. It's important to note that this issue was addressed in subsequent commits after the vulnerability was identified.