PT-2023-13227 · Unknown · Btcpay Server

Antoine Poinsot · Publicado 2023-01-31 · Atualizado 2023-02-08 · CVE-2022-32984

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions BTCPay Server versions 1.3.0 through 1.5.3

Description The issue allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed. This sensitive information, found in the HTML source code, includes the xpub of the store. Additionally, if the store is not using the internal lightning node, the credentials of a lightning node are exposed.

Recommendations For BTCPay Server versions 1.3.0 through 1.5.3, consider restricting access to the public Point of Sale app to minimize the risk of sensitive information exposure. As a temporary workaround, review the HTML source code to ensure no sensitive data is inadvertently exposed. Restrict access to the xpub of the store and lightning node credentials until a patch is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2022-32984

Produtos afetados

Btcpay Server

Referências · 4

• https://t.me/cibsecurity/57233 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-32984 · Aviso do Fabricante
• https://blog.btcpayserver.org/btcpay-server-cve-2022-32984 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-32984 · Nota de Segurança