CVE-2018-1000875
Last modified
CVE-2018-1000875 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Berkeley Open Infrastructure for Network Computing BOINC Server and Website Code version 0.9-1.0.2 contains a CWE-302: Authentication Bypass by Assumed-Immutable Data vulnerability in Website Terms of Service Acceptance Page that can result in Access to any user account. This attack appear to be exploitable via Specially crafted URL. EPSS estimates a 1.68% chance of exploitation in the next 30 days.
Description
Berkeley Open Infrastructure for Network Computing BOINC Server and Website Code version 0.9-1.0.2 contains a CWE-302: Authentication Bypass by Assumed-Immutable Data vulnerability in Website Terms of Service Acceptance Page that can result in Access to any user account. This attack appear to be exploitable via Specially crafted URL. This vulnerability appears to have been fixed in 1.0.3.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Universityofcalifornia | Boinc Server | >= 1.0.0, < 1.0.3 |
References
- https://github.com/BOINC/boinc/issues/2907Issue Tracking, Mitigation, Third Party Advisory
- https://github.com/BOINC/boinc/issues/2907Issue Tracking, Mitigation, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2018-1000875?
How severe is CVE-2018-1000875?
How do I fix CVE-2018-1000875?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-1000869phpIPAM version 1.3.2 contains a CWE-89 vulnerability in /ap…
- CVE-2018-1000870PHPipam version 1.3.2 and earlier contains a CWE-79 vulnerab…
- CVE-2018-1000871HotelDruid HotelDruid 2.3.0 version 2.3.0 and earlier contai…
- CVE-2018-1000872OpenKMIP PyKMIP version All versions before 0.8.0 contains a…
- CVE-2018-1000873Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Im…6.5
- CVE-2018-1000874PHP cebe markdown parser version 1.2.0 and earlier contains …6.1
- CVE-2018-1000876binutils version 2.32 and earlier contains a Integer Overflo…7.8
- CVE-2018-1000877libarchive version commit 416694915449219d505531b1096384f323…8.8
- CVE-2018-1000878libarchive version commit 416694915449219d505531b1096384f323…8.8
- CVE-2018-1000879libarchive version commit 379867ecb330b3a952fb7bfa7bffb7bbd5…6.5
- CVE-2018-1000880libarchive version commit 9693801580c0cf7c70e862d305270a16b5…6.5
- CVE-2018-1000881Traccar Traccar Server version 4.0 and earlier contains a CW…
Are you affected by CVE-2018-1000875?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST