vulnwire
5.3med

CVE-2017-180161 exploit

Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting o…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
5.3
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
5.5%
percentile 93%
Public exploits
1
Exploit-DB

Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine (reusing the current website's token, which is not bound to an origin).

Exploit prediction (EPSS)

5.48% probability of exploitation in the next 30 days, higher than 93% of all scored CVEs.

Exploits and detections

  • EDB-43499 Parity Browser < 1.6.10 - Bypass Same Origin Policy · local · 2018-01-10

CVSS scores

Assigned byVersionScoreVector
NVD3.05.3CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness

References

  • github.com /tintinweb/pub/tree/master/pocs/cve-2017-18016 · x_refsource_MISC, x_transferred
  • openwall.com /lists/oss-security/2018/01/10/1 · mailing-list, x_refsource_MLIST, x_transferred
  • exploit-db.com /exploits/43499/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • github.com /paritytech/parity/commit/53609f703e2f1af76441344ac3b72811c726a215 · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.