Vulnerabilities > CVE-2018-3972 - Deserialization of Untrusted Data vulnerability in Getmonero Monero 0.12.2.0

047910
CVSS 9.8 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
getmonero
CWE-502
critical
NVD
Published: 2018-09-26
Updated: 2024-11-21

Summary

An exploitable code execution vulnerability exists in the Levin deserialization functionality of the Epee library, as used in Monero 'Lithium Luna' (v0.12.2.0-master-ffab6700) and other cryptocurrencies. A specially crafted network packet can cause a logic flaw, resulting in code execution. An attacker can send a packet to trigger this vulnerability.

Vulnerable Configurations

Part Description Count
Application
Getmonero
1

Common Weakness Enumeration (CWE)

Talos

idTALOS-2018-0637
last seen2019-05-29
published2018-09-25
reporterTalos Intelligence
sourcehttp://www.talosintelligence.com/vulnerability_reports/TALOS-2018-0637
titleEpee Levin Packet Deserialization Code Execution Vulnerability

References