CVE-2018-25098 json
blockmason credit-protocol UCAC CreditProtocol.sol executeUcacTx denial of service
published 2024-02-04 2 y ago modified 2026-06-17 4 mo ago also EUVD-2018-13850
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in blockmason credit-protocol. It has been declared as problematic. Affected by this vulnerability is the function executeUcacTx of the file contracts/CreditProtocol.sol of the component UCAC Handler. The manipulation leads to denial of service. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The patch is named 082e01f18707ef995e80ebe97fcedb229a55efc5. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-252799. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Patch / fix
- blockmason credit-protocol 2018-04-11
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.87% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| CNA | 3.0 | 4.3 | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| CNA | 2.0 | 3.3 | AV:A/AC:L/Au:N/C:N/I:N/A:P |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
- blockmason credit-protocol
Classification
References
-
github.com
/blockmason/credit-protocol/pull/33
issue-tracking, patch
-
github.com
/blockmason/credit-protocol/commit/082e01f18707ef995e80ebe97fcedb229a55efc5
patch
-
vuldb.com
/?id.252799
vdb-entry, technical-description, third-party-advisory
-
vuldb.com
/?ctiid.252799
signature, permissions-required
Sources
- CVE List CVE-2018-25098
- NVD CVE-2018-25098
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.