CVE-2018-11687

{"id": "CVE-2018-11687", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-08-15T17:29:00.517", "references": [{"url": "https://www.anquanke.com/post/id/147913", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "An integer overflow in the distributeBTR function of a smart contract implementation for Bitcoin Red (BTCR), an Ethereum ERC20 token, allows the owner to accomplish an unauthorized increase of digital assets by providing a large address[] array, as exploited in the wild in May 2018, aka the \"ownerUnderflow\" issue."}, {"lang": "es", "value": "Un desbordamiento de enteros en la funci\u00f3n distributeBTR de una implementaci\u00f3n de contrato inteligente para Bitcoin Red (BTCR), un token de Ethereum ERC20, permite que el propietario logre un aumento no autorizado de los activos digitales proporcionando un array address[] grande, tal y como se explot\u00f3 \"in the wild\" en mayo de 2018. Este problema tambi\u00e9n se conoce como \"ownerUnderflow\"."}], "lastModified": "2018-10-15T19:31:43.220", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bitcoin_red_project:bitcoin_red:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "596F3B6C-1E55-447D-9D97-49BF751A22BF"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}