Back to search
CVE-2018-6651
Published: Feb 5, 2018
Modified: Aug 5, 2024
PUBLISHED
Description
In the uncurl_ws_accept function in uncurl.c in uncurl before 0.07, as used in Parsec before 140-3, insufficient Origin header validation (accepting an arbitrary substring match) for WebSocket API requests allows remote attackers to bypass intended access restrictions. In Parsec, this means full control over the victim's computer.
| Vendor | Product | Versions |
|---|---|---|
n/a | n/a | affected n/a |
References
https://github.com/chrisd1100/uncurl/releases/tag/0.07
x_refsource_CONFIRM
https://gist.github.com/Zenexer/ac7601c0e367d876353137e5099b18a7
x_refsource_MISC
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now