CVEvulnerability
CVE-2017-18016
5.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2018-01-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 5.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-346
Description
Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine (reusing the current website's token, which is not bound to an origin).
Affected configurations
• parity browser 1.6.10
Related
Weakness · CWE (1)
- CWE-346 Origin Validation Error weakness
References
- http://www.openwall.com/lists/oss-security/2018/01/10/1 Exploit, Mailing List, Third Party Advisory
- https://github.com/paritytech/parity/commit/53609f703e2f1af76441344ac3b72811c726a215 Patch, Third Party Advisory
- https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016 Exploit, Technical Description, Third Party Advisory
- https://www.exploit-db.com/exploits/43499/ Exploit, Third Party Advisory, VDB Entry
- http://www.openwall.com/lists/oss-security/2018/01/10/1 Exploit, Mailing List, Third Party Advisory
- https://github.com/paritytech/parity/commit/53609f703e2f1af76441344ac3b72811c726a215 Patch, Third Party Advisory
- https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016 Exploit, Technical Description, Third Party Advisory
- https://www.exploit-db.com/exploits/43499/ Exploit, Third Party Advisory, VDB Entry