CVE-2026-3193

Katalog CVE

CVSS 3.1 · Low EPSS 0,23%

Kerentanan Cross-Site Request Forgery (CSRF) pada chia blockchain. Skor CVSS 3.1 3.1 (Low) menurut vuldb.com.

Deskripsi (NVD)

A vulnerability was detected in Chia Blockchain 2.1.0. Impacted is an unknown function of the file /send_transaction. The manipulation results in cross-site request forgery. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was informed early via email. A separate report via bugbounty was rejected with the reason "This is by design. The user is responsible for host security".

Rincian

Terbit di NVD

25 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.1 (Low), sumber vuldb.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-352: Cross-Site Request Forgery (CSRF)
CWE-862: Missing Authorization

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 13,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Danimlzg/chia-rpc-auth-bypass.git exploit · advisory pihak ketiga
• https://vuldb.com/?id.347749 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.347749 permissions required · vdb entry