CVE-2020-15130 - Vulnerability Details - OpenCVE

ReportizFlow

In SLPJS (npm package slpjs) before version 0.27.4, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 0.27.4.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:N/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Simpleledger	Slpjs

Configuration 1 [-]

cpe:2.3:a:simpleledger:slpjs:*:*:*:*:*:node.js:*:*

No data.

References

Link	Providers
https://github.com/simpleledger/slpjs/commit/290c20e8bff13ac81459d43e54cac232b5e3456c
https://github.com/simpleledger/slpjs/security/advisories/GHSA-cc2p-4jhr-xhhx

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2020-07-30T15:00:24

Updated: 2024-08-04T13:08:22.292Z

Reserved: 2020-06-25T00:00:00

Link: CVE-2020-15130

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-07-30T15:15:13.057

Modified: 2024-11-21T05:04:54.477

Link: CVE-2020-15130

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "slpjs", "vendor": "simpleledger", "versions": [{"status": "affected", "version": "< 0.27.4"}]}], "descriptions": [{"lang": "en", "value": "In SLPJS (npm package slpjs) before version 0.27.4, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 0.27.4."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-697", "description": "CWE-697: Incorrect Comparison", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-07-30T15:00:23", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/simpleledger/slpjs/security/advisories/GHSA-cc2p-4jhr-xhhx"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/simpleledger/slpjs/commit/290c20e8bff13ac81459d43e54cac232b5e3456c"}], "source": {"advisory": "GHSA-cc2p-4jhr-xhhx", "discovery": "UNKNOWN"}, "title": "False-positive validity for NFT1 genesis transactions in SLPJS", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2020-15130", "STATE": "PUBLIC", "TITLE": "False-positive validity for NFT1 genesis transactions in SLPJS"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "slpjs", "version": {"version_data": [{"version_value": "< 0.27.4"}]}}]}, "vendor_name": "simpleledger"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In SLPJS (npm package slpjs) before version 0.27.4, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 0.27.4."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-697: Incorrect Comparison"}]}]}, "references": {"reference_data": [{"name": "https://github.com/simpleledger/slpjs/security/advisories/GHSA-cc2p-4jhr-xhhx", "refsource": "CONFIRM", "url": "https://github.com/simpleledger/slpjs/security/advisories/GHSA-cc2p-4jhr-xhhx"}, {"name": "https://github.com/simpleledger/slpjs/commit/290c20e8bff13ac81459d43e54cac232b5e3456c", "refsource": "MISC", "url": "https://github.com/simpleledger/slpjs/commit/290c20e8bff13ac81459d43e54cac232b5e3456c"}]}, "source": {"advisory": "GHSA-cc2p-4jhr-xhhx", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T13:08:22.292Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/simpleledger/slpjs/security/advisories/GHSA-cc2p-4jhr-xhhx"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/simpleledger/slpjs/commit/290c20e8bff13ac81459d43e54cac232b5e3456c"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2020-15130", "datePublished": "2020-07-30T15:00:24", "dateReserved": "2020-06-25T00:00:00", "dateUpdated": "2024-08-04T13:08:22.292Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:simpleledger:slpjs:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "1EAA7BF1-0BF4-491A-8E92-3A5BAFFC2156", "versionEndExcluding": "0.27.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In SLPJS (npm package slpjs) before version 0.27.4, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 0.27.4."}, {"lang": "es", "value": "En SLPJS (npm package slpjs) versiones anteriores a 0.27.4, se presenta una vulnerabilidad en los resultados de comprobaci\u00f3n de falsos-positivos para el tipo de transacci\u00f3n NFT1 Child Genesis. Una billetera SLP implementada inapropiadamente o un atacante oportunista podr\u00eda crear un token secundario NFT1 aparentemente v\u00e1lido sin grabar ninguno de los tipos de token del Grupo NFT1 como lo requiere la especificaci\u00f3n NFT1. Esto es corregido en la versi\u00f3n 0.27.4"}], "id": "CVE-2020-15130", "lastModified": "2024-11-21T05:04:54.477", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2020-07-30T15:15:13.057", "references": [{"source": "[email protected]", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/simpleledger/slpjs/commit/290c20e8bff13ac81459d43e54cac232b5e3456c"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://github.com/simpleledger/slpjs/security/advisories/GHSA-cc2p-4jhr-xhhx"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/simpleledger/slpjs/commit/290c20e8bff13ac81459d43e54cac232b5e3456c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/simpleledger/slpjs/security/advisories/GHSA-cc2p-4jhr-xhhx"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-697"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-697"}], "source": "[email protected]", "type": "Primary"}]}