High severity · published Jan 31, 2023
CVE-2022-32984
BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed
7.5
CVSS
1%
EPSS
No
On KEV
Description
BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed. The sensitive information, found in the HTML source code, includes the xpub of the store. Also, if the store isn't using the internal lightning node, the credentials of a lightning node are exposed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BS
Btcpay Server · Btcpayserver
1.3.0 through 1.5.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-32984
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-32984
Vendor Advisory
https://blog.btcpayserver.org/btcpay-server-cve-2022-32984/
More from Btcpay Server
8.8
CVE-2023-0493
Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver
7.5
CVE-2021-29249
BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability
6.7
CVE-2021-29246
BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achieve code execution
6.5
CVE-2021-29251
BTCPay Server before 1.0.7.1 mishandles the policy setting in which users can register (in Server Settings > Policies)
6.1
CVE-2021-3646
Cross-site Scripting (XSS) - Reflected in btcpayserver/btcpayserver