CVE-2018-12070

{"id": "CVE-2018-12070", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-06-25T11:29:00.497", "references": [{"url": "https://peckshield.com/2018/06/11/tradeTrap/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://peckshield.com/2018/06/11/tradeTrap/", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "The sell function of a smart contract implementation for SEC, a tradable Ethereum ERC20 token, allows a potential trap that could be used to cause financial damage to the seller, because of overflow of the multiplication of its argument amount and a manipulable variable sellPrice, aka the \"tradeTrap\" issue."}, {"lang": "es", "value": "La funci\u00f3n sell de una implementaci\u00f3n de contrato inteligente para SEC, un token de Ethereum ERC20 intercambiable, permite una trampa potencial que podr\u00eda emplearse para provocar un da\u00f1o financiero al vendedor debido al desbordamiento de la multiplicaci\u00f3n de su cantidad de argumentos y una variable sellPrice manipulada. Esto tambi\u00e9n se conoce como problema \"tradeTrap\"."}], "lastModified": "2024-11-21T03:44:31.870", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sec_project:sec:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0F7660DE-29CB-4C6A-A233-ACA5C210F71D"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}