Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2017-12116: Ethereum Aleth permits unauthorized gas price changes
CVE-2017-12116 · published 8 years ago
Summary
The Aleth client for Ethereum can be tricked into changing the miner's gas price without proper permission. This could let an attacker influence transaction costs or disrupt network operations. Apply the latest update from the vendor or restrict access to the JSON‑RPC interface to mitigate the risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| ethereum | aleth |
All versions
cpe:2.3:a:ethereum:aleth:-:*:*:*:*:*:*:* |
Original advisory text
An exploitable improper authorization vulnerability exists in miner_setGasPrice API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access ...
An exploitable improper authorization vulnerability exists in miner_setGasPrice API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to the restricted functionality resulting in authorization bypass. An attacker can send JSON to trigger this vulnerability.
References
- http://www.securityfocus.com/bid/102475 Broken Link Third Party Advisory VDB Entry
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0468 Exploit Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-863Incorrect Authorization
Timeline
Published19 Jan 2018
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-12116 · NVD
Track software like this
Free during beta