CVE-2020-15130 - CVE House
Back to Database
Status published High CVE-2020-15130

False-positive validity for NFT1 genesis transactions in SLPJS

Vulnerability Description

In SLPJS (npm package slpjs) before version 0.27.4, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 0.27.4.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-15130

Credits & Attribution

No credits recorded in the NVD database.

References

More from simpleledger

View All →
CVE-2020-15131
False-positive validity for NFT1 genesis transactions in SLP Validate
High 7.5
CVE-2020-11072
False-negative validation results in MINT transactions with invalid baton
High 8.6
CVE-2020-11071
False-negative validation results in MINT transactions with invalid baton
High 8.6
CVE-2020-11014
BIP LI01 output reordering may cause malformed SLP MINT transactions in Electron-Cash-SLP
Medium 6.1
CVE-2019-16762
Validator parsing discrepancy due to string encoding in NPM slpjs
Medium 5.7

Affected Vendor

simpleledger

View all reports →

Affected Software

slpjs
Vulnerable Versions:
< 0.27.4

Timeline

Official Publish: July 30th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-697

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.