Wormable Flaw, 0days Lead Sept. 2022 Patch Tuesday
60
CVE-2022-32984
—CVSS 3.1
7.5 high
EPSS
1%p61
Published
()
Modified
Description
BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed. The sensitive information, found in the HTML source code, includes the xpub of the store. Also, if the store isn't using the internal lightning node, the credentials of a lightning node are exposed.
- Vendors
- btcpayserver
- Products
- btcpay server
- Weakness
- CWE-200
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N