Kurz gesagt
- CVE-2022-35917 ist eine Schwachstelle (MITTEL (CVSS 5.3)) in pay (solanalabs), @solana/pay.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.87%, höher als bei 58.9% aller Schwachstellen.
- Abhilfe: auf 0.2.1 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| pay | < 0.2.1
| 0.2.1
|
| @solana/pay npm | < 0.2.1
| 0.2.1
|
Description
Description
When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient, using the supplied validateTransfer function. An edge case regarding this mechanism could cause the validation logic to validate multiple transfers.
Impact
Most known Solana Pay point of sale applications are currently run on physical point of sale devices, which makes this issue unlikely to occur. However, there may be web-based point of sale applications using the protocol where it may be more likely to occur.
Patches
This issue has been patched as of version 0.2.1. Users of the Solana Pay SDK should upgrade to it.
NVD description
Solana Pay is a protocol and set of reference implementations that enable developers to incorporate decentralized payments into their apps and services. When a Solana Pay transaction is located using a reference key, it may be checked to represent a transfer of the desired amount to the recipient, using the supplied `validateTransfer` function. An edge case regarding this mechanism could cause the validation logic to validate multiple transfers. This issue has been patched as of version `0.2.1`. Users of the Solana Pay SDK should upgrade to it. There are no known workarounds for this issue.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free