CVE-2019-16752: CSRF

Q: Which products and versions are identified as affected?

The issue affects Decentralized Anonymous Payment System (DAPS) through 2019-08-26, Dash Core through 0.14.0.3, and PIVX through 3.4.0.

Q: What does successful exploitation allow?

An attacker can cause a wallet to send HTTP requests to arbitrary destinations on the local network or the internet. This may expose the user's IP address and reveal that they are using the affected product.

Q: Does exploitation require authentication or direct access to the wallet?

The supplied CVSS vector indicates no privileges are required and exploitation is network-based, but user interaction is required. The provided data does not specify the form of interaction or the delivery mechanism.

Published Dec 4, 2019

Updated

An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. It is possible to force wallets to send HTTP requests to arbitrary locations, both on the local network and on the internet. This is a serious threat to user privacy, since it can possibly leak their IP address and the fact that they are using the product. This also affects Dash Core through 0.14.0.3 and Private Instant Verified Transactions (PIVX) through 3.4.0.

Affected Software

3 affected components

Dash Dash Core<=0.14.0.3

Officialdapscoin Decentralized Anonymous Payment System<=2019-08-26

PIVX Private Instant Verified Transactions<=3.4.0

Event History

Dec 4, 2019

CVE Published

via MITRE·07:30 PM

Data Sourced

via MITRE·07:30 PM

Description

Frequently Asked Questions

Which products and versions are identified as affected?

The issue affects Decentralized Anonymous Payment System (DAPS) through 2019-08-26, Dash Core through 0.14.0.3, and PIVX through 3.4.0.

What does successful exploitation allow?

An attacker can cause a wallet to send HTTP requests to arbitrary destinations on the local network or the internet. This may expose the user's IP address and reveal that they are using the affected product.

Does exploitation require authentication or direct access to the wallet?

The supplied CVSS vector indicates no privileges are required and exploitation is network-based, but user interaction is required. The provided data does not specify the form of interaction or the delivery mechanism.

CVE-2019-16752: CSRF

Affected Software

Event History

Frequently Asked Questions

Which products and versions are identified as affected?

What does successful exploitation allow?

Does exploitation require authentication or direct access to the wallet?

Company

Resources

Contact

Frequently Asked Questions

Which products and versions are identified as affected?

What does successful exploitation allow?

Does exploitation require authentication or direct access to the wallet?