What is CVE-2019-16752?

CVE-2019-16752 is a medium-severity vulnerability in Dash Core, classified under Cross-Site Request Forgery (CSRF). CVSS score: 4.3/10. Published 2019-12-04.

How severe is CVE-2019-16752?

Medium severity. CVSS v3 base score is 4.3 out of 10.

CSRF in Dash Core

CVE-2019-16752

An issue was discovered in Decentralized Anonymous Payment System (DAPS) through 2019-08-26. It is possible to force wallets to send HTTP requests to arbitrary locations, both on the local network and on the internet. This is a serious threat to user privacy, since it can possibly leak their IP address and the fact that they are using the product. This also affects Dash Core through 0.14.0.3 and Private Instant Verified Transactions (PIVX) through 3.4.0.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.004 (33.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N.

Affected products

Dash Dash_core
Officialdapscoin Decentralized_anonymous_payment_system
Pivx Private_instant_verified_transactions
N/a — versions n/a

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

cve@mitre.org (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2019-16752?: CVE-2019-16752 is a medium-severity vulnerability in Dash Core, classified under Cross-Site Request Forgery (CSRF). CVSS score: 4.3/10. Published 2019-12-04.
How severe is CVE-2019-16752?: Medium severity. CVSS v3 base score is 4.3 out of 10.