CVE-2017-18016

Опубликовано: 11 янв. 2018

Источник: nvd

CVSS3: 5.3

CVSS2: 5

EPSS Низкий

Описание

Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine (reusing the current website's token, which is not bound to an origin).

Ссылки

http://www.openwall.com/lists/oss-security/2018/01/10/1
Exploit
Mailing List
Third Party Advisory
https://github.com/paritytech/parity/commit/53609f703e2f1af76441344ac3b72811c726a215
Patch
Third Party Advisory
https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016
Exploit
Technical Description
Third Party Advisory
https://www.exploit-db.com/exploits/43499/
Exploit
Third Party Advisory
VDB Entry
http://www.openwall.com/lists/oss-security/2018/01/10/1
Exploit
Mailing List
Third Party Advisory
https://github.com/paritytech/parity/commit/53609f703e2f1af76441344ac3b72811c726a215
Patch
Third Party Advisory
https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016
Exploit
Technical Description
Third Party Advisory
https://www.exploit-db.com/exploits/43499/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:parity:browser:1.6.10:*:*:*:*:*:*:*

EPSS

Процентиль: 79%

0.01252

Низкий

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-346

Связанные уязвимости

GHSA-5f5w-x6vw-hmqm