PT-2019-17964 · Nicehash · Nicehash Miner

Ashutosh Barot · Published 2019-11-06 · Updated 2019-11-08 · CVE-2019-6121

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions NiceHash Miner versions prior to 2.0.3.0

Description An issue allows an adversary to gain access to a miner's information, including recent payments, unclaimed balance, old balance, projected payout, and mining statistics such as profitability and efficiency, by exploiting missing authorization. A valid email address is required to retrieve this information.

Recommendations For versions prior to 2.0.3.0, update to version 2.0.3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information until the update is applied.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2019-6121

Affected Products

Nicehash Miner

References · 4

• 🔥 https://cyberworldmirror.com/nicehash-vulnerability-leaked-miners-information · Exploit
• 🔥 https://docs.google.com/document/d/1OubhuTRzuTMnkZ9SCFb8BtJVbTu840wDxyWu3VWHwvs/edit · Exploit
• https://osv.dev/vulnerability/CVE-2019-6121 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6121 · Security Note