CVE-2020-15131 - Vulnerability Details - OpenCVE

ReportizFlow

In SLP Validate (npm package slp-validate) before version 1.2.2, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 1.2.2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

AV:N/AC:L/Au:N/C:N/I:P/A:N

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Simpleledger	Slp-validate

Configuration 1 [-]

cpe:2.3:a:simpleledger:slp-validate:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/simpleledger/slp-validate.js/commit/3963cf914afae69084059b82483da916d97af65c
https://github.com/simpleledger/slp-validate.js/security/advisories/GHSA-6jmr-jfh7-xg3h

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2020-07-30T15:00:17

Updated: 2024-08-04T13:08:22.279Z

Reserved: 2020-06-25T00:00:00

Link: CVE-2020-15131

Vulnrichment

No data.

NVD

Status : Modified

Published: 2020-07-30T15:15:13.150

Modified: 2024-11-21T05:04:54.613

Link: CVE-2020-15131

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "slp-validate.js", "vendor": "simpleledger", "versions": [{"status": "affected", "version": "< 1.2.2"}]}], "descriptions": [{"lang": "en", "value": "In SLP Validate (npm package slp-validate) before version 1.2.2, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 1.2.2."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-697", "description": "CWE-697: Incorrect Comparison", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-07-30T15:00:17", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/simpleledger/slp-validate.js/security/advisories/GHSA-6jmr-jfh7-xg3h"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/simpleledger/slp-validate.js/commit/3963cf914afae69084059b82483da916d97af65c"}], "source": {"advisory": "GHSA-6jmr-jfh7-xg3h", "discovery": "UNKNOWN"}, "title": "False-positive validity for NFT1 genesis transactions in SLP Validate", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2020-15131", "STATE": "PUBLIC", "TITLE": "False-positive validity for NFT1 genesis transactions in SLP Validate"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "slp-validate.js", "version": {"version_data": [{"version_value": "< 1.2.2"}]}}]}, "vendor_name": "simpleledger"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In SLP Validate (npm package slp-validate) before version 1.2.2, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 1.2.2."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-697: Incorrect Comparison"}]}]}, "references": {"reference_data": [{"name": "https://github.com/simpleledger/slp-validate.js/security/advisories/GHSA-6jmr-jfh7-xg3h", "refsource": "CONFIRM", "url": "https://github.com/simpleledger/slp-validate.js/security/advisories/GHSA-6jmr-jfh7-xg3h"}, {"name": "https://github.com/simpleledger/slp-validate.js/commit/3963cf914afae69084059b82483da916d97af65c", "refsource": "MISC", "url": "https://github.com/simpleledger/slp-validate.js/commit/3963cf914afae69084059b82483da916d97af65c"}]}, "source": {"advisory": "GHSA-6jmr-jfh7-xg3h", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T13:08:22.279Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/simpleledger/slp-validate.js/security/advisories/GHSA-6jmr-jfh7-xg3h"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/simpleledger/slp-validate.js/commit/3963cf914afae69084059b82483da916d97af65c"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2020-15131", "datePublished": "2020-07-30T15:00:17", "dateReserved": "2020-06-25T00:00:00", "dateUpdated": "2024-08-04T13:08:22.279Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:simpleledger:slp-validate:*:*:*:*:*:*:*:*", "matchCriteriaId": "2917828A-1F9A-4875-BB53-ADD30D7D5972", "versionEndExcluding": "1.2.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In SLP Validate (npm package slp-validate) before version 1.2.2, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 1.2.2."}, {"lang": "es", "value": "En SLP Validate (npm package slp-validate) versiones anteriores a 1.2.2, se presenta una vulnerabilidad en los resultados de comprobaci\u00f3n de falsos-positivos para el tipo de transacci\u00f3n NFT1 Child Genesis. Una billetera SLP implementada inapropiadamente o un atacante oportunista podr\u00eda crear un token secundario NFT1 aparentemente v\u00e1lido sin grabar ninguno de los tipos de token del Grupo NFT1 como son requeridos por la especificaci\u00f3n NFT1. Esto es corregido en la versi\u00f3n 1.2.2"}], "id": "CVE-2020-15131", "lastModified": "2024-11-21T05:04:54.613", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2020-07-30T15:15:13.150", "references": [{"source": "[email protected]", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/simpleledger/slp-validate.js/commit/3963cf914afae69084059b82483da916d97af65c"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://github.com/simpleledger/slp-validate.js/security/advisories/GHSA-6jmr-jfh7-xg3h"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/simpleledger/slp-validate.js/commit/3963cf914afae69084059b82483da916d97af65c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/simpleledger/slp-validate.js/security/advisories/GHSA-6jmr-jfh7-xg3h"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-697"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-697"}], "source": "[email protected]", "type": "Primary"}]}