PT-2018-9213 · Electrum · Electrum Bitcoin Wallet

Theymos · Publicado 2018-02-09 · Atualizado 2019-10-03 · CVE-2018-1000022

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Electrum Bitcoin Wallet versions prior to 3.0.5

Description: The issue concerns a Missing Authorization vulnerability in the JSONRPC interface, which can lead to Bitcoin theft if the user's wallet is not password protected. This can be exploited when the victim visits a web page with specially crafted JavaScript.

Recommendations: For versions prior to 3.0.5, update to version 3.0.5 or later to resolve the issue. As a temporary workaround, consider ensuring that the wallet is password protected to minimize the risk of exploitation.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2018-1000022

Produtos afetados

Electrum Bitcoin Wallet

Referências · 8

• https://github.com/spesmilo/electrum/issues/3374 · Nota
• https://electrum.org/#home · Nota
• https://security-tracker.debian.org/tracker/CVE-2018-1000022 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1000022 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000022 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000022 · Nota de Segurança
• https://bitcointalk.org/index.php?topic=2702103.0 · Nota
• https://reddit.com/r/Bitcoin/comments/7ooack/critical_electrum_vulnerability · Nota