CVE-2022-31246: Medium severity electrum bitcoin wallet vulnerability
paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the r parameter of a payment request (e.g., within QR code data). On Windows, this can lead to capture of credentials over SMB. On Linux and UNIX, it can lead to a denial of service by specifying the /dev/zero filename.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-31246?
CVE-2022-31246 has a medium severity rating of 5.5 according to the CVSS 3.1 score.
What does CVE-2022-31246 affect?
CVE-2022-31246 affects the paymentrequest.py component in Electrum versions prior to 4.2.2.
How can CVE-2022-31246 be exploited?
CVE-2022-31246 can be exploited by manipulating the r parameter in a payment request, potentially capturing credentials on Windows or causing a denial of service on Linux and UNIX.
How do I fix CVE-2022-31246?
To fix CVE-2022-31246, update Electrum to version 4.2.2 or later.
Is there a workaround for CVE-2022-31246?
Currently, there are no recommended workarounds for CVE-2022-31246 other than upgrading the affected software.