CVE-2018-10831

{"id": "CVE-2018-10831", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-05-09T05:29:00.217", "references": [{"url": "https://blog.zencash.com/update-for-the-equihash-mining-application-z-nomp/", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/edwardz246003/misc/blob/master/Attackers%20Fake%20Computational%20Power%20to%20Steal%20Cryptocurrencies%20from%20Mining%20Pools.md", "tags": ["Exploit", "Technical Description", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-327"}]}], "descriptions": [{"lang": "en", "value": "Z-NOMP before 2018-04-05 has an incorrect Equihash solution verifier that allows attackers to spoof mining shares, as demonstrated by providing a solution with {x1=1,x2=1,x3=1,...,x512=1} to bypass this verifier for any blockheader. This originally affected (for example) the Bitcoin Gold and Zcash cryptocurrencies, and continued to be exploited in the wild in May 2018 against smaller cryptocurrencies."}, {"lang": "es", "value": "Z-NOMP en versiones anteriores al 2018-04-05 tiene un verificador de soluciones Equihash incorrecto que permite que atacantes suplanten recursos de miner\u00eda compartidos, tal y como queda demostrado al proporcionar una soluci\u00f3n con {x1=1,x2=1,x3=1,...,x512=1} para omitir este verificador en cualquier cabecera de bloque. Esto afect\u00f3 originalmente, por ejemplo, a las criptomonedas Bitcoin Gold y Zcash, y sigui\u00f3 siendo explotado \"in the wild\" en mayo de 2018 contra criptomonedas m\u00e1s peque\u00f1as."}], "lastModified": "2018-06-18T16:46:26.313", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zclassic:z-nomp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "963DAD09-CA96-498C-A87D-39D689E733F6", "versionEndIncluding": "1.0.5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}