CVE-2018-1000022

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Electrum Technologies GmbH Electrum Bitcoin Wallet version prior to version 3.0.5 contains a Missing Authorization vulnerability in JSONRPC interface that can result in Bitcoin theft, if the user's wallet is not password protected. This attack appear to be exploitable via The victim must visit a web page with specially crafted javascript. This vulnerability appears to have been fixed in 3.0.5.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bitcointalk.org/index.php?topic=2702103.0Third Party Advisory
https://electrum.org/#homeProduct
https://github.com/spesmilo/electrum/issues/3374Third Party Advisory
https://www.reddit.com/r/Bitcoin/comments/7ooack/critical_electrum_vulnerability/Third Party Advisory
https://bitcointalk.org/index.php?topic=2702103.0Third Party Advisory
https://electrum.org/#homeProduct
https://github.com/spesmilo/electrum/issues/3374Third Party Advisory
https://www.reddit.com/r/Bitcoin/comments/7ooack/critical_electrum_vulnerability/Third Party Advisory

Timeline

Published: Feb 9, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-10000235.3Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint CVE-2018-10000247.5The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerabil CVE-2018-10000258.1Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 to 3.8.0 contains a Incorrect Access Control vulnerability in src/Firebase/Auth/I CVE-2018-10000267.7Linux Linux kernel version at least v4.8 onwards, probably well before contains a Insufficient input validation vulnerability in bnx2x netwo CVE-2018-10000277.5The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Dereference vulnerability in CVE-2018-10000287.4Linux kernel version after commit bdcf0a423ea1 - 4.15-rc4+, 4.14.8+, 4.9.76+, 4.4.111+ contains a Incorrect Access Control vulnerability in CVE-2018-10000296.1mcholste Enterprise Log Search and Archive (ELSA) version revision 1205, commit 2cc17f1 and earlier contains a Cross Site Scripting (XSS) vu CVE-2018-10000303.6Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as well as a Heap-Use-After-Free. Python versions prior to 2.7.14 may also be vulnerab CVE-2018-10000317.8A heap-based buffer overflow exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service or to possibly CVE-2018-10000327.8A heap-based buffer overflow exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service or to possibly CVE-2018-10000339.1An out-of-bounds read exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service and read sensitive mem CVE-2018-10000349.1An out-of-bounds read exists in Info-Zip UnZip version 6.10c22 that allows an attacker to perform a denial of service and read sensitive mem