QwikSec

Security Database

CVE

CWE

Training

CVE-2017-18016

Published: Jan 11, 2018

Modified: Aug 5, 2024

PUBLISHED

Description

Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine (reusing the current website's token, which is not bound to an origin).

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016

x_refsource_MISC

[oss-security] 20180110 CVE-2017-18016 - Paritytech Parity Ethereum built-in Dapp Browser <= v1.6.10 webproxy token reuse same-origin policy bypass

mailing-list

x_refsource_MLIST

exploit

x_refsource_EXPLOIT-DB

https://github.com/paritytech/parity/commit/53609f703e2f1af76441344ac3b72811c726a215

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.