Security readout for executives and security teams
Plain-English summary
CVE-2018-1000875 is an authentication bypass in BOINC Server and Website Code. A vulnerable Terms of Service acceptance page could let an attacker access any user account via a specially crafted URL. The sources say versions 0.9 through 1.0.2 are affected and 1.0.3 fixes it.
Executive priority
Treat this as high priority if your organization runs a BOINC project website. The stated worst case is access to any user account, but evidence is sparse and there is no confirmed active exploitation in the provided sources.
Technical view
The flaw is described as CWE-302, authentication bypass by assumed-immutable data, in the BOINC website Terms of Service acceptance flow. Public source detail is limited, but the stated impact is account access across users. No CVSS score or CPE data is provided in the bundle.
Likely exposure
Exposure is likely limited to organizations operating BOINC Server and Website Code versions 0.9 through 1.0.2, especially public BOINC project websites with user accounts and Terms of Service acceptance enabled.
Exploitation context
The CVE description says exploitation is possible through a specially crafted URL. The provided sources do not state active exploitation, and the CVE is not marked as CISA KEV.
Researcher notes
Public data is thin: no CVSS vector, no CPE list, and only one GitHub issue reference is named. Do not infer additional affected components beyond BOINC Server and Website Code 0.9 through 1.0.2.
Mitigation direction
- Upgrade BOINC Server and Website Code to version 1.0.3 or later.
- Confirm public BOINC website instances are not running versions 0.9 through 1.0.2.
- Review BOINC vendor or project guidance for any additional hardening notes.
- Increase monitoring for suspicious account access until upgrade is complete.
Validation and detection
- Inventory BOINC server and website code versions across all project hosts.
- Verify upgraded systems report version 1.0.3 or later.
- Review account access logs for unusual activity involving user-account pages.
- Check whether Terms of Service acceptance flows remain publicly reachable on legacy hosts.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Credential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2018-1000875 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/BOINC/boinc/issues/2907CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.