Btcpay Server CVE-2021-29245

MEDIUM

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)

2021-05-05 cve@mitre.org

Information Disclosure Btcpay Server

5.3

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

1

CVE Published

May 05, 2021 - 13:15 nvd

MEDIUM 5.3

DescriptionNVD

BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key.

AnalysisAI

BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-338. BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key. Affected products include: Btcpayserver Btcpay Server. Version information: through 1.0.7.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Btcpay Server

View all

CVE-2023-0493 HIGH This Week POC

Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5. Ra

CVE-2021-3646 MEDIUM This Month POC

btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rate

CVE-2023-1149 MEDIUM This Month POC

Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0. Ra

CVE-2023-0879 MEDIUM This Month POC

Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.12. Rated medium severit

CVE-2021-3830 MEDIUM This Month POC

btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rate

CVE-2021-29249 HIGH This Week

BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability. Rated high severity (CVSS 7.

CVE-2021-29246 MEDIUM This Month

BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achiev

CVE-2021-29251 MEDIUM This Month

BTCPay Server before 1.0.7.1 mishandles the policy setting in which users can register (in Server Settings > Policies).

CVE-2021-29250 MEDIUM This Month

BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting (XSS) vulnerability within the POS Add Products

CVE-2021-29248 MEDIUM This Month

BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set th

CVE-2021-29247 MEDIUM This Month

BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set th

Same weakness CWE-338 – Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

View all

CVE-2023-36993 CRITICAL POC

CVE-2019-16303 CRITICAL POC

CVE-2024-29868 CRITICAL POC

CVE-2022-35255 CRITICAL POC

CVE-2025-1796 HIGH POC

CVE-2023-27791 HIGH POC

CVE-2019-10754 HIGH POC

CVE-2019-5440 HIGH POC

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

CVE-2023-7028 CRITICAL POC

CVE-2017-0213 HIGH POC

Share

CVE-2021-29245 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy