CVE-2018-6849

moderate-risk
Published 2018-04-01

In the WebRTC component in DuckDuckGo 4.2.0, after visiting a web site that attempts to gather complete client information (such as https://ip.voidsec.com), the browser can disclose a private IP address in a STUN request.

Do I need to act?

!
75.3% chance of exploitation in next 30 days
EPSS score — higher than 25% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
44403
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.3/10 Medium
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Duckduckgo

References (10)

Third Party Advisory https://datarift.blogspot.com/p/private-ip-leakage-using-webrtc.html
Issue Tracking https://github.com/rapid7/metasploit-framework/pull/9538
Third Party Advisory https://news.ycombinator.com/item?id=16699270
Third Party Advisory https://voidsec.com/vpn-leak/
Exploit https://www.exploit-db.com/exploits/44403/
Third Party Advisory https://datarift.blogspot.com/p/private-ip-leakage-using-webrtc.html
Issue Tracking https://github.com/rapid7/metasploit-framework/pull/9538
Third Party Advisory https://news.ycombinator.com/item?id=16699270
Third Party Advisory https://voidsec.com/vpn-leak/
Exploit https://www.exploit-db.com/exploits/44403/
43
/ 100
moderate-risk
Severity 18/34 · Moderate
Exploitability 20/34 · Moderate
Exposure 5/34 · Minimal