Lucene search

GitHub_MCVELIST:CVE-2020-11072

HistoryMay 12, 2020 - 12:45 a.m.

CVE-2020-11072 False-negative validation results in MINT transactions with invalid baton

2020-05-1200:45:12

CWE-697

GitHub_M

www.cve.org

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

8.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.9%

JSON

In SLP Validate (npm package slp-validate) before version 1.2.1, users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user’s minting baton. This has been fixed in slp-validate in version 1.2.1. Additonally, slpjs version 0.27.2 has a related fix under related CVE-2020-11071.

CNA Affected

[
  {
    "product": "slp-validate",
    "vendor": "simpleledger",
    "versions": [
      {
        "status": "affected",
        "version": "< 1.2.1"
      }
    ]
  }
]

References

github.com/simpleledger/slp-validate/commit/cde95c0c6470dceb4f023cd462f904135ebd73e7

github.com/simpleledger/slp-validate/security/advisories/GHSA-4w97-57v2-3w44

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

8.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.9%

JSON

Related for CVELIST:CVE-2020-11072