CVE-2017-12116: High severity ethereum blockchain vulnerability

Published Jan 19, 2018

Updated

An exploitable improper authorization vulnerability exists in minersetGasPrice API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger this vulnerability.

Affected Software

1 affected component

Ethereum Aleth

Event History

Jan 19, 2018

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2017-12116.

What is the severity of CVE-2017-12116?

The severity of CVE-2017-12116 is high with a score of 8.1.

What software is affected by CVE-2017-12116?

The Ethereum Aleth software is affected by CVE-2017-12116.

What is the impact of CVE-2017-12116?

An attacker can bypass authorization and access restricted functionality.

Are there any references for CVE-2017-12116?

Yes, you can find references for CVE-2017-12116 at the following links: [1](http://www.securityfocus.com/bid/102475), [2](https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0468).