medium5.3Public exploit code
CVE-2017-18016
Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via th…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Parity Browser < 1.6.10 - Bypass Same Origin Policy2018-01-10 · local · multiple
Impact
Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine (reusing the current website's token, which is not bound to an origin).
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Parity | Browser | Version 1.6.10 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.openwall.com/lists/oss-security/2018/01/10/1
- https://github.com/paritytech/parity/commit/53609f703e2f1af76441344ac3b72811c726a215
- https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016
- https://www.exploit-db.com/exploits/43499/
- http://www.openwall.com/lists/oss-security/2018/01/10/1
- https://github.com/paritytech/parity/commit/53609f703e2f1af76441344ac3b72811c726a215
- https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016
- https://www.exploit-db.com/exploits/43499/