CVE-2018-17968

{"id": "CVE-2018-17968", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-10-23T21:30:53.737", "references": [{"url": "https://github.com/TEAM-C4B/CVE-LIST/tree/master/CVE-2018-17968", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-338"}]}], "descriptions": [{"lang": "en", "value": "A gambling smart contract implementation for RuletkaIo, an Ethereum gambling game, generates a random value that is predictable by an external contract call. The developer wrote a random() function that uses a block timestamp and block hash from the Ethereum blockchain. This can be predicted by writing the same random function code in an exploit contract to determine the deadSeat value."}, {"lang": "es", "value": "Una implementaci\u00f3n de contrato inteligente de apuestas para RuletkaIo, un token de apuestas de Ethereum, genera un valor aleatorio predecible mediante una llamada externa de contrato. El desarrollador escribi\u00f3 una funci\u00f3n random() que emplea una marca de tiempo de bloque y un hash de bloque del blockchain de Ethereum. Esto se puede predecir escribiendo el mismo c\u00f3digo de funci\u00f3n aleatoria en un contrato de exploit para determinar el valor deadSeat."}], "lastModified": "2018-12-08T02:26:05.660", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ruletkaio:ruletkaio:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B15397B6-0091-4322-8255-B9D1AB2A9959"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}