Lucene search

GitHub_MVULNRICHMENT:CVE-2024-34694

HistoryJun 14, 2024 - 2:31 p.m.

CVE-2024-34694 LNbits improperly handles potential network and payment failures when using Eclair backend

2024-06-1414:31:12

CWE-754

GitHub_M

github.com

lnbits

vulnerability

eclair

payments

funds loss

fix

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

6.7

Confidence

Low

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. This vulnerability is fixed in 0.12.6.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:lnbits:lnbits:*:*:*:*:*:*:*:*"
    ],
    "vendor": "lnbits",
    "product": "lnbits",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "0.12.6",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AI Score

6.7

Confidence

Low

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

Related for VULNRICHMENT:CVE-2024-34694