paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request (e.g., within QR code data). On Windows, this can lead to capture of credentials over SMB. On Linux and UNIX, it can lead to a denial of service by specifying the /dev/zero filename.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2022-06-17T13:39:22
Updated: 2024-08-03T07:11:39.871Z
Reserved: 2022-05-20T00:00:00
Link: CVE-2022-31246
Vulnrichment
No data.
NVD
Status : Modified
Published: 2022-06-17T14:15:08.127
Modified: 2024-11-21T07:04:12.730
Link: CVE-2022-31246
Redhat
No data.