CVE-2017-14460

An exploitable overly permissive cross-domain (CORS) whitelist vulnerability exists in JSON-RPC of Parity Ethereum client version 1.7.8. An automatically sent JSON object to JSON-RPC endpoint can trigger this vulnerability. A victim needs to visit a malicious website to trigger this vulnerability.

Score

CVSS 3.0 7.5 High

Status

Modified - talos-cna@cisco.com

Published

2018-01-19

Last modified

2024-09-17

Affected products

• Ethereum Client (Parity)
• Parity (Talos)

References

• https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0508