How severe is CVE-2018-11713?

CVE-2018-11713 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2018-11713 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (73rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2018-11713?

CVE-2018-11713 primarily affects Webkitgtk Webkitgtk+. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2018-11713?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2018-11713 published?

CVE-2018-11713 was published on 2018-06-04 and last updated on 2026-06-17.

CVE-2018-11713

CVE-2018-11713 is a medium-severity vulnerability in Webkitgtk Webkitgtk+ with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v2: 4.3
EPSS exploit prediction: 2% (73rd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Webkitgtk Webkitgtk+
Published: 2018-06-04
Last modified: 2026-06-17

Description

WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to version 2.20.0 or without libsoup 2.62.0, unexpectedly failed to use system proxy settings for WebSocket connections. As a result, users could be deanonymized by crafted web sites via a WebSocket connection.

Frequently asked questions

What is CVE-2018-11713?: WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to version 2.20.0 or without libsoup 2.62.0, unexpectedly failed to use system proxy settings for WebSocket connections. As a result, users could be deanonymized by crafted web sites via a WebSocket connection.
How severe is CVE-2018-11713?: CVE-2018-11713 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2018-11713 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (73rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2018-11713?: CVE-2018-11713 primarily affects Webkitgtk Webkitgtk+. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2018-11713?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2018-11713 published?: CVE-2018-11713 was published on 2018-06-04 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:a:webkitgtk:webkitgtk\+:*:*:*:*:*:*:*:*
cpe:2.3:a:gnome:libsoup:*:*:*:*:*:*:*:*

More vulnerabilities in Webkitgtk Webkitgtk+

CVE-2019-8375 — Critical (CVSS 9.8): The UIProcess subsystem in WebKit, as used in WebKitGTK through 2.23.90 and WebKitGTK+ through 2.22.6 and other…
CVE-2018-12911 — Critical (CVSS 9.8): WebKitGTK+ 2.20.3 has an off-by-one error, with a resultant out-of-bounds write, in the get_simple_globs functions in…
CVE-2017-1000121 — Critical (CVSS 9.8): The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate message size metadata,…
CVE-2023-42917 — High (CVSS 8.8): A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS…
CVE-2023-41993 — High (CVSS 8.8): The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead…
CVE-2023-37450 — High (CVSS 8.8): The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS…

All CVEs affecting Webkitgtk Webkitgtk+ →