Information disclosure in Btcpayserver Btcpay Server
CVE-2022-32984
BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed. The sensitive information, found in the HTML source code, includes the xpub of the store. Also, if the store isn't using the internal lightning node, the credentials of a lightning node are exposed.
Vulnerability class: Information Disclosure
EPSS: 0.010 (61.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Btcpayserver Btcpay_server
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-32984?
- CVE-2022-32984 is a high-severity vulnerability in Btcpayserver Btcpay Server, classified under Information Disclosure. CVSS score: 7.5/10. Published 2023-01-31.
- How severe is CVE-2022-32984?
- High severity. CVSS v3 base score is 7.5 out of 10.