CVE-2017-12112: High severity Ethereum cpp-ethereum vulnerability

Published Jan 19, 2018

Updated

An exploitable improper authorization vulnerability exists in adminaddPeer API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger this vulnerability.

Affected Software

1 affected component

Ethereum cpp-ethereum

Event History

Jan 19, 2018

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2017-12112?

CVE-2017-12112 is an improper authorization vulnerability in the admin_addPeer API of cpp-ethereum's JSON-RPC.

How severe is CVE-2017-12112?

CVE-2017-12112 has a severity rating of 8.1, which is considered high.

What software is affected by CVE-2017-12112?

The affected software is cpp-ethereum, specifically the Ethereum Cpp-ethereum version.

How can an attacker exploit CVE-2017-12112?

An attacker can exploit CVE-2017-12112 by sending a malicious JSON request to the admin_addPeer API, bypassing authorization and gaining access to restricted functionality.

Are there any references for CVE-2017-12112?

Yes, you can find more information about CVE-2017-12112 at the following references: [SecurityFocus](http://www.securityfocus.com/bid/102475) and [Talos Intelligence](https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0464).