CVE-2018-25022

Katalog CVE

CVSS 3.1 · Low EPSS 1,6%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada toktok toxcore. Skor CVSS 3.1 3.1 (Low) menurut NVD.

Deskripsi (NVD)

The Onion module in toxcore before 0.2.2 doesn't restrict which packets can be onion-routed, which allows a remote attacker to discover a target user's IP address (when knowing only their Tox Id) by positioning themselves close to target's Tox Id in the DHT for the target to establish an onion connection with the attacker, guessing the target's DHT public key and creating a DHT node with public key close to it, and finally onion-routing a NAT Ping Request to the target, requesting it to ping the just created DHT node.

Rincian

Terbit di NVD

13 Desember 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.1 (Low), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 74,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://blog.tox.chat/2018/04/security-vulnerability-and-new-toxcore-release exploit · advisory vendor
• https://github.com/TokTok/c-toxcore/pull/872 patch · advisory pihak ketiga
• https://github.com/TokTok/c-toxcore/issues/873 exploit · issue tracking · advisory pihak ketiga