CVE-2021-3401

Katalog CVE

CVSS 9.8 · Critical EPSS 10,5%

Kerentanan Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') pada bitcoin. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Bitcoin Core before 0.19.0 might allow remote attackers to execute arbitrary code when another application unsafely passes the -platformpluginpath argument to the bitcoin-qt program, as demonstrated by an x-scheme-handler/bitcoin handler for a .desktop file or a web browser. NOTE: the discoverer states "I believe that this vulnerability cannot actually be exploited."

Rincian

Terbit di NVD

4 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

EPSS (30 hari)

10,5% peluang dieksploitasi; lebih tinggi dari 95,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bitcoin/bitcoin/pull/16578 patch · advisory pihak ketiga
• https://achow101.com/2021/02/0.18-uri-vuln advisory pihak ketiga