PoC Index

CVE-2017-14460

HIGH 7.5EPSS 1.2%

An exploitable overly permissive cross-domain (CORS) whitelist vulnerability exists in JSON-RPC of Parity Ethereum client version 1.7.8. An automatically sent JSON object to JSON-RPC endpoint can trigger this vulnerability. A victim needs to visit a malicious website to trigger this vulnerability.

CVSS v3.0
7.5 HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v3.0
7.5 HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0
5.1 MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:P
EPSS
1.18% chance of exploitation in the next 30 days, 66th percentile
Published
2018-01-19
Updated
2024-09-17

Proof-of-concept exploits (1)

References

Related