CVE-2020-15131CWE-697

False-positive validity for NFT1 genesis transactions in SLP Validate

High · published July 30, 2020

CVSS v3.1
7.5
EPSS
1%
Percentile
63.6
In the wild
Unconfirmed
What it is

In SLP Validate (npm package slp-validate) before version 1.2.2, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 1.2.2.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01036 · 63.6th percentile
Weakness
CWE-697 · Incorrect Comparison
Published
2020-07-30T15:00Z
EPSS history
Timeline
  • 30 JUL 15:00Z
    False-positive validity for NFT1 genesis transactions in SLP Validate
    cvelistv5