How severe is CVE-2017-12118?

CVE-2017-12118 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2017-12118 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (76th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-12118?

CVE-2017-12118 affects Ethereum Cpp-ethereum. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2017-12118?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2017-12118 published?

CVE-2017-12118 was published on 2018-01-19 and last updated on 2026-06-17.

CVE-2017-12118

CVE-2017-12118 is a high-severity vulnerability in Ethereum Cpp-ethereum with a CVSS 3.x base score of 8.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-863.

Key facts

Severity: High (CVSS 3.x base score 8.1)
CVSS v2: 6.8
EPSS exploit prediction: 2% (76th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-863
Affected product: Ethereum Cpp-ethereum
Published: 2018-01-19
Last modified: 2026-06-17

Description

An exploitable improper authorization vulnerability exists in miner_stop API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). An attacker can send JSON to trigger this vulnerability.

Frequently asked questions

What is CVE-2017-12118?: An exploitable improper authorization vulnerability exists in miner_stop API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). An attacker can send JSON to trigger this vulnerability.
How severe is CVE-2017-12118?: CVE-2017-12118 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2017-12118 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (76th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2017-12118?: CVE-2017-12118 affects Ethereum Cpp-ethereum. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2017-12118?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2017-12118 published?: CVE-2017-12118 was published on 2018-01-19 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:ethereum:cpp-ethereum:-:*:*:*:*:*:*:*

More vulnerabilities in Ethereum Cpp-ethereum

CVE-2017-12113 — High (CVSS 8.1): An exploitable improper authorization vulnerability exists in admin_nodeInfo API of cpp-ethereum's JSON-RPC (commit…
CVE-2017-12117 — High (CVSS 8.1): An exploitable improper authorization vulnerability exists in miner_start API of cpp-ethereum's JSON-RPC (commit…
CVE-2017-12115 — High (CVSS 8.1): An exploitable improper authorization vulnerability exists in miner_setEtherbase API of cpp-ethereum's JSON-RPC (commit…
CVE-2017-12112 — High (CVSS 8.1): An exploitable improper authorization vulnerability exists in admin_addPeer API of cpp-ethereum's JSON-RPC (commit…
CVE-2017-12119 — High (CVSS 7.5): An exploitable unhandled exception vulnerability exists in multiple APIs of CPP-Ethereum JSON-RPC. Specially crafted…
CVE-2017-12114 — Medium (CVSS 6.8): An exploitable improper authorization vulnerability exists in admin_peers API of cpp-ethereum's JSON-RPC (commit…

All CVEs affecting Ethereum Cpp-ethereum →

Other CWE-863 (Incorrect Authorization) vulnerabilities

CVE-2026-111812 — Critical (CVSS 10.0): Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers…
CVE-2026-90532 — Critical (CVSS 10.0): Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code…
CVE-2026-48383 — Critical (CVSS 10.0): Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code…
CVE-2026-48382 — Critical (CVSS 10.0): Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code…
CVE-2026-75745 — Critical (CVSS 10.0): Adobe Experience Manager Forms JEE is affected by an Incorrect Authorization vulnerability that could result in…
CVE-2026-75723 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary…

Browse all CWE-863 (Incorrect Authorization) vulnerabilities →