Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine (reusing the current website's token, which is not bound to an origin).
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2018/01/10/1 | Exploit Mailing List Third Party Advisory |
| https://github.com/paritytech/parity/commit/53609f703e2f1af76441344ac3b72811c726a215 | Patch Third Party Advisory |
| https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016 | Exploit Technical Description Third Party Advisory |
| https://www.exploit-db.com/exploits/43499/ | Exploit Third Party Advisory VDB Entry |
| http://www.openwall.com/lists/oss-security/2018/01/10/1 | Exploit Mailing List Third Party Advisory |
| https://github.com/paritytech/parity/commit/53609f703e2f1af76441344ac3b72811c726a215 | Patch Third Party Advisory |
| https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016 | Exploit Technical Description Third Party Advisory |
| https://www.exploit-db.com/exploits/43499/ | Exploit Third Party Advisory VDB Entry |
Configurations
History
21 Nov 2024, 03:19
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2018/01/10/1 - Exploit, Mailing List, Third Party Advisory | |
| References | () https://github.com/paritytech/parity/commit/53609f703e2f1af76441344ac3b72811c726a215 - Patch, Third Party Advisory | |
| References | () https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016 - Exploit, Technical Description, Third Party Advisory | |
| References | () https://www.exploit-db.com/exploits/43499/ - Exploit, Third Party Advisory, VDB Entry |
Information
Published : 2018-01-11 16:29
Updated : 2024-11-21 03:19
NVD link : CVE-2017-18016
Mitre link : CVE-2017-18016
CVE.ORG link : CVE-2017-18016
JSON object : View
Products Affected
parity
- browser
CWE
CWE-346
Origin Validation Error