CVE-2018-12056 describes a critical vulnerability in the All For One Ethereum gambling game's smart contract. The maxRandom function, intended for random value generation, uses publicly readable variables, specifically the _seed value, which can be retrieved via a getStorageAt call. This allows attackers to predict outcomes, ensuring they always win and receive rewards. Rated 7.5 HIGH on CVSS, this vulnerability has a low attack complexity and requires no user interaction, making it easily exploitable over the network. The potential impact is high confidentiality compromise, as attackers can gain unauthorized access to game rewards. There is currently no evidence of active exploitation, nor are there any public exploit modules available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, indicating a low level of public awareness.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:a:all-for-one:all_for_one:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.