CVE-2018-10376

{"id": "CVE-2018-10376", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": true, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-04-25T09:29:00.707", "references": [{"url": "https://dasp.co/#item-3", "tags": ["Not Applicable"], "source": "cve@mitre.org"}, {"url": "https://peckshield.com/2018/04/25/proxyOverflow/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.reddit.com/r/ethereum/comments/8esyg9/okex_erc20_bug/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "An integer overflow in the transferProxy function of a smart contract implementation for SmartMesh (aka SMT), an Ethereum ERC20 token, allows attackers to accomplish an unauthorized increase of digital assets via crafted _fee and _value parameters, as exploited in the wild in April 2018, aka the \"proxyOverflow\" issue."}, {"lang": "es", "value": "Un desbordamiento de enteros en la funci\u00f3n transferProxy de una implementaci\u00f3n de contrato inteligente SmartMesh (SMT), un token de Ethereum ERC20, permite que atacantes logren un aumento no autorizado de los activos digitales mediante los par\u00e1metros manipulados _fee y _value, tal y como se explot\u00f3 \"in the wild\" en abril de 2018. Este problema tambi\u00e9n se conoce como \"proxyOverflow\"."}], "lastModified": "2018-06-13T15:29:11.360", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:smartmesh:smartmesh:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBF19213-D3B8-443E-AFDE-6E5339F899C0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}