Lucene search

[email protected]CVE-2019-16752

HistoryDec 04, 2019 - 8:15 p.m.

CVE-2019-16752

2019-12-0420:15:12

CWE-352

[email protected]

web.nvd.nist.gov

cve

daps

dash core

pivx

http request

vulnerability

privacy threat

security advisory

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.7%

JSON

An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. It is possible to force wallets to send HTTP requests to arbitrary locations, both on the local network and on the internet. This is a serious threat to user privacy, since it can possibly leak their IP address and the fact that they are using the product. This also affects Dash Core through 0.14.0.3 and Private Instant Verified Transactions (PIVX) through 3.4.0.

Affected configurations

NVD

Node

dashdash_coreRange≤0.14.0.3

officialdapscoindecentralized_anonymous_payment_systemRange≤2019-08-26

pivxprivate_instant_verified_transactionsRange≤3.4.0

CPENameOperatorVersion
dash:dash_coredash dash corele0.14.0.3
officialdapscoin:decentralized_anonymous_payment_systemofficialdapscoin decentralized anonymous payment systemle2019-08-26
pivx:private_instant_verified_transactionspivx private instant verified transactionsle3.4.0

CPE	Name	Operator	Version
dash:dash_core	dash dash core	le	0.14.0.3
officialdapscoin:decentralized_anonymous_payment_system	officialdapscoin decentralized anonymous payment system	le	2019-08-26
pivx:private_instant_verified_transactions	pivx private instant verified transactions	le	3.4.0

References

officialdapscoin.com/wp-content/uploads/2019/09/DAPS-Coin-Final-Security-Audit-Red4Sec-2019.pdf

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.7%

JSON

Related for CVE-2019-16752

cvelist1 osv1 prion1 nvd1