CVE-2017-18016

Published: Jan 11, 2018Modified: Nov 21, 2024

5.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine (reusing the current website's token, which is not bound to an origin).

Affected (1)

Products: Parity: Browser

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Parity Browser	Version 1.6.10

Related CWEs

Origin Validation Error

The product does not properly verify that the source of data or communication is valid.

References (8)

http://www.openwall.com/lists/oss-security/2018/01/10/1

Source: cve@mitre.org

ExploitMailing ListThird Party Advisory

https://github.com/paritytech/parity/commit/53609f703e2f1af76441344ac3b72811c726a215

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016

Source: cve@mitre.org

ExploitTechnical DescriptionThird Party Advisory

https://www.exploit-db.com/exploits/43499/

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

http://www.openwall.com/lists/oss-security/2018/01/10/1

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitMailing ListThird Party Advisory

https://github.com/paritytech/parity/commit/53609f703e2f1af76441344ac3b72811c726a215

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitTechnical DescriptionThird Party Advisory

https://www.exploit-db.com/exploits/43499/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

Timeline

No history available yet.