Vulnerability Details : CVE-2018-18425
Potential exploit
The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency. (Increasing the total supply by using 'doAirdrop' ignores the hard cap written in the contract and devalues the token.)
Products affected by CVE-2018-18425
- cpe:2.3:a:primeo_project:primeo:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-18425
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 39 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-18425
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:N/I:P/A:N |
8.0
|
2.9
|
NIST | |
6.5
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
2.8
|
3.6
|
NIST |
CWE ids for CVE-2018-18425
-
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-18425
-
https://www.jianshu.com/p/09f238e9e568
Primeo (PEO)增发漏洞 - 简书Exploit;Patch;Third Party Advisory
-
https://etherscan.io/address/0x21a8a03b34e053f9b1d4545213d9d1d411a9d449#code
Ethereum Accounts, Addresses and ContractsThird Party Advisory
Jump to