Description
BTCPay Server before 1.0.7.1 mishandles the policy setting in which users can register (in Server Settings > Policies). This affects Docker use cases in which a mail server is configured.
References
https://blog.btcpayserver.org/vulnerability-disclosure-v1-0-7-0/
Release NotesVendor Advisory
https://github.com/btcpayserver/btcpayserver/releases/tag/v1.0.7.1
Release NotesThird Party Advisory
CVSS impact metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
6.5 · Medium
CVSS V3.1
CVSS V3.0
CVSS V2.0
Information
Source identifier
Vulnerability status
Analyzed
Published
2021-04-01T05:15:13.233
4 years agoLast modified
2021-06-02T18:47:44.827
4 years ago