« Volver al listado

CVE-2024-34694

Estado: AplazadaAlta (8.1)—

LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. This vulnerability is fixed in 0.12.6.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Acinq — EclairAILnbits — LnbitsAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-34694",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-34694",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-15T20:13:48.624804Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "lnbits",
          "product": "lnbits",
          "versions": [
            {
              "status": "affected",
              "version": "< 0.12.6"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:lnbits:lnbits:*:*:*:*:*:*:*:*"
          ],
          "vendor": "lnbits",
          "product": "lnbits",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "0.12.6",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-06-14T15:15:50.637",
  "references": [
    {
      "url": "https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/lnbits/lnbits/security/advisories/GHSA-3j4h-h3fp-vwww",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-754"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "LNbits is a Lightning wallet and accounts system. Paying invoices in Eclair that do not get settled within the internal timeout (about 30s) lead to a payment being considered failed, even though it may still be in flight. This vulnerability can lead to a total loss of funds for the node backend. This vulnerability is fixed in 0.12.6.\n"
    },
    {
      "lang": "es",
      "value": "LNbits es un sistema de cuentas y billetera Lightning. Pagar facturas en Eclair que no se liquidan dentro del tiempo de espera interno (alrededor de 30 segundos) hace que el pago se considere fallido, aunque todavía pueda estar en proceso. Esta vulnerabilidad puede provocar una pérdida total de fondos para el backend del nodo. Esta vulnerabilidad se solucionó en 0.12.6."
    }
  ],
  "lastModified": "2026-06-17T07:33:53.567",
  "sourceIdentifier": "security-advisories@github.com"
}