CVE-2018-15552
Last modified
CVE-2018-15552 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a random value with publicly readable variable "maxTickets" (which is private, yet predictable and readable by the eth.getStorageAt function). Therefore, it allows attackers to always win and get rewards.. EPSS estimates a 1.17% chance of exploitation in the next 30 days.
Description
The "PayWinner" function of a simplelottery smart contract implementation for The Ethereum Lottery, an Ethereum gambling game, generates a random value with publicly readable variable "maxTickets" (which is private, yet predictable and readable by the eth.getStorageAt function). Therefore, it allows attackers to always win and get rewards.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Theethereumlottery | The Ethereum Lottery | All versions |
References
- https://github.com/TEAM-C4B/CVE-LIST/tree/master/CVE-2018-15552Exploit, Third Party Advisory
- https://github.com/TEAM-C4B/CVE-LIST/tree/master/CVE-2018-15552Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-15552?
How severe is CVE-2018-15552?
How do I fix CVE-2018-15552?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-1554IBM Maximo Asset Management 7.6 is vulnerable to cross-site …5.4
- CVE-2018-15540Agentejo Cockpit performs actions on files without appropria…
- CVE-2018-15542An issue was discovered in the org.telegram.messenger applic…
- CVE-2018-15543An issue was discovered in the org.telegram.messenger applic…
- CVE-2018-15546Accusoft PrizmDoc version 13.3 and earlier contains a Stored…
- CVE-2018-1555IBM FileNet Content Manager 5.2.1 and 5.5.0 is vulnerable to…5.4
- CVE-2018-15553fileshare.cmd on Telus Actiontec T2200H T2200H-31.128L.03 de…
- CVE-2018-15555On Telus Actiontec WEB6000Q v1.1.02.22 devices, an attacker …
- CVE-2018-15556The Quantenna WiFi Controller on Telus Actiontec WEB6000Q v1…
- CVE-2018-15557An issue was discovered in the Quantenna WiFi Controller on …
- CVE-2018-15559The editor in Xiuno BBS 4.0.4 allows stored XSS.
- CVE-2018-1556IBM FileNet Content Manager 5.2.1 and 5.5.0 is vulnerable to…5.4
Are you affected by CVE-2018-15552?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST