CVE-2018-6651
highpriority · track · 36EPSS 0.024 · 84 %ileEUUSEPSS · scored 2026-10-27
In the uncurl_ws_accept function in uncurl.c in uncurl before 0.07, as used in Parsec before 140-3, insufficient Origin header validation (accepting an arbitrary substring match) for WebSocket API requests allows remote attackers to bypass intended access restrictions. In Parsec, this means full control over the victim's computer.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (3)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (9)
External citations — patches, advisories, analysis.
- https://gist.github.com/Zenexer/ac7601c0e367d876353137e5099b18a7cnnvd
- https://github.com/chrisd1100/uncurl/commit/448cd13e7b18c83855d706c564341ddd1e38e769cnnvd
- https://github.com/chrisd1100/uncurl/releases/tag/0.07cnnvd
- https://gist.github.com/Zenexer/ac7601c0e367d876353137e5099b18a7enisa_euvd
- https://github.com/chrisd1100/uncurl/commit/448cd13e7b18c83855d706c564341ddd1e38e769enisa_euvd
- https://github.com/chrisd1100/uncurl/releases/tag/0.07enisa_euvd
- https://gist.github.com/Zenexer/ac7601c0e367d876353137e5099b18a7nvd
- https://github.com/chrisd1100/uncurl/commit/448cd13e7b18c83855d706c564341ddd1e38e769PatchThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan