PT-2018-9213 · Electrum · Electrum Bitcoin Wallet

Theymos · Published 2018-02-09 · Updated 2019-10-03 · CVE-2018-1000022

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Electrum Bitcoin Wallet versions prior to 3.0.5

Description: The issue concerns a Missing Authorization vulnerability in the JSONRPC interface, which can lead to Bitcoin theft if the user's wallet is not password protected. This can be exploited when the victim visits a web page with specially crafted JavaScript.

Recommendations: For versions prior to 3.0.5, update to version 3.0.5 or later to resolve the issue. As a temporary workaround, consider ensuring that the wallet is password protected to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2018-1000022

Affected Products

Electrum Bitcoin Wallet

References · 8

• https://security-tracker.debian.org/tracker/CVE-2018-1000022 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1000022 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000022 · Security Note
• https://github.com/spesmilo/electrum/issues/3374 · Note
• https://electrum.org/#home · Note
• https://bitcointalk.org/index.php?topic=2702103.0 · Note
• https://reddit.com/r/Bitcoin/comments/7ooack/critical_electrum_vulnerability · Note