CVE-2017-18016

Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine (reusing the current website's token, which is not bound to an origin).

CVSS v3.0

5.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

5.48% chance of exploitation in the next 30 days, 92th percentile

Published

2018-01-11

Updated

2024-08-05

Proof-of-concept exploits (2)

• http://www.openwall.com/lists/oss-security/2018/01/10/1
• tintinweb/pub/tree/master/pocs/cve-2017-18016

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/43499

References

• CVE Record
• NVD entry

Related

• CVE-2017-8798
• CVE-2018-10057
• CVE-2018-10058
• CVE-2020-15690
• CVE-2017-18015
• CVE-2017-18019