CVE-2020-11072
High
Description
In SLP Validate (npm package slp-validate) before version 1.2.1, users could experience false-negative validation outcomes for MINT transaction operations. A poorly implemented SLP wallet could allow spending of the affected tokens which would result in the destruction of a user's minting baton. This has been fixed in slp-validate in version 1.2.1. Additonally, slpjs version 0.27.2 has a related fix under related CVE-2020-11071.
SeverityHigh
CVSS8.6
Exploit probability—
ProductSimpleledger Slp-validate
PublishedMay 12, 2020
First seenMay 12, 2020
Weakness typeCWE-697CWE-697
How to fix
Update
- simpleledger slp-validate1.2.1 or later
- slp-validate1.2.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| simpleledger slp-validate | v < 1.2.1 | 1.2.1 |
| slp-validatenpm | v < 1.2.1 | 1.2.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.