What’s Vulnerable › Vulnerabilities

CVE-2017-18016

• Severity: medium (CVSS 5.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-01-11 · updated 2026-06-17
• Weakness: CWE-346

Description

Parity Browser 1.6.10 and earlier allows remote attackers to bypass the Same Origin Policy and obtain sensitive information by requesting other websites via the Parity web proxy engine (reusing the current website's token, which is not bound to an origin).

Affected products

• Parity Browser: 1.6.10

References

• http://www.openwall.com/lists/oss-security/2018/01/10/1
• https://github.com/paritytech/parity/commit/53609f703e2f1af76441344ac3b72811c726a215
• https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016
• https://www.exploit-db.com/exploits/43499/
• http://www.openwall.com/lists/oss-security/2018/01/10/1
• https://github.com/paritytech/parity/commit/53609f703e2f1af76441344ac3b72811c726a215
• https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-18016
• https://www.exploit-db.com/exploits/43499/

Get alerted when CVE-2017-18016 or the next vulnerability affects your stack