CVE-2018-1000875

{"id": "CVE-2018-1000875", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2018-12-20T17:29:01.003", "references": [{"url": "https://github.com/BOINC/boinc/issues/2907", "tags": ["Mitigation", "Third Party Advisory", "Issue Tracking"], "source": "cve@mitre.org"}, {"url": "https://github.com/BOINC/boinc/issues/2907", "tags": ["Mitigation", "Third Party Advisory", "Issue Tracking"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Berkeley Open Infrastructure for Network Computing BOINC Server and Website Code version 0.9-1.0.2 contains a CWE-302: Authentication Bypass by Assumed-Immutable Data vulnerability in Website Terms of Service Acceptance Page that can result in Access to any user account. This attack appear to be exploitable via Specially crafted URL. This vulnerability appears to have been fixed in 1.0.3."}, {"lang": "es", "value": "Berkeley Open Infrastructure for Network Computing BOINC Server and Website Code, en su versi\u00f3n 0.9-1.0.2, contiene una vulnerabilidad CWE-302: omisi\u00f3n de autenticaci\u00f3n por datos que se asume que son inmutables en la p\u00e1gina de \"Website Terms of Service Acceptance\" que puede resultar en el acceso a cualquier cuenta de usuario. Este ataque parece ser explotable mediante una URL especialmente manipulada. La vulnerabilidad parece haber sido solucionada en la versi\u00f3n 1.0.3."}], "lastModified": "2025-07-08T18:02:19.117", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:universityofcalifornia:boinc_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C66C55C9-3832-4BCE-9740-DB35BB44AFBA", "versionEndExcluding": "1.0.3", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}