CVE-2018-6651 Cross-site request forgery in n/a
Insufficient Origin header validation in Parsec allows remote attackers to bypass access restrictions and gain full control of the victim's computer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-6651?
CVE-2018-6651 is a high-severity vulnerability in n/a, published on 5 Feb 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In the uncurl_ws_accept function in uncurl.c in uncurl before 0.07, as used in Parsec before 140-3, insufficient Origin header validation (accepting an arbitrary substring match) for WebSocket API requests allows remote attackers to bypass intended access restrictions. In Parsec, this means full control over the victim's computer.
Weakness: CWE-352
Which versions are affected by CVE-2018-6651?
It affects 2 products.
Products include Parsecgaming Parsec, Uncurl Project Uncurl.
How do I fix CVE-2018-6651?
No fix has been published for CVE-2018-6651 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-6651 being exploited?
There is no known exploitation of CVE-2018-6651 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-g952-h9rv-wc2r.