What is CVE-2018-19830?

CVE-2018-19830 is a high-severity vulnerability in Business Alliance Financial Circle Project, classified under Missing Authorization. CVSS score: 7.5/10. Published 2019-12-31.

How severe is CVE-2018-19830?

High severity. CVSS v3 base score is 7.5 out of 10.

Is CVE-2018-19830 known to be exploited?

4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Business Alliance Financial Circle Project

CVE-2018-19830

The UBSexToken() function of a smart contract implementation for Business Alliance Financial Circle (BAFC), an tradable Ethereum ERC20 token, allows attackers to change the owner of the contract, because the function is public (by default) and does not check the caller's identity.

Vulnerability class: Broken Access Control

EPSS: 0.009 (57.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Business_alliance_financial_circle_project Business_alliance_financial_circle
N/a — versions n/a

Weakness classification (CWE)

CWE-862 — Missing Authorization

Public proof-of-concept exploits

References

cve@mitre.org (x_refsource_MISC)

Frequently asked questions

What is CVE-2018-19830?: CVE-2018-19830 is a high-severity vulnerability in Business Alliance Financial Circle Project, classified under Missing Authorization. CVSS score: 7.5/10. Published 2019-12-31.
How severe is CVE-2018-19830?: High severity. CVSS v3 base score is 7.5 out of 10.
Is CVE-2018-19830 known to be exploited?: 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.