CVE-2022-32984

BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed. The sensitive information, found in the HTML source code, includes the xpub of the store. Also, if the store isn't using the internal lightning node, the credentials of a lightning node are exposed.

• CWE-200

• https://blog.btcpayserver.org/btcpay-server-cve-2022-32984/Vendor Advisory
• https://blog.btcpayserver.org/btcpay-server-cve-2022-32984/Vendor Advisory

Published

Jan 31, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-32973An authenticated attacker could create an audit file that by…8.8
• CVE-2022-32974An authenticated attacker could read arbitrary files from th…6.5
• CVE-2022-32978There is an assertion failure in SingleComponentLSScan::Pars…6.5
• CVE-2022-3298Allocation of Resources Without Limits or Throttling in GitH…7.5
• CVE-2022-32981An issue was discovered in the Linux kernel through 5.18.3 o…7.8
• CVE-2022-32983Knot Resolver through 5.5.1 may allow DNS cache poisoning wh…5.3
• CVE-2022-32985libnx_apl.so on Nexans FTTO GigaSwitch before 6.02N and 7.x …9.8
• CVE-2022-32987Multiple cross-site scripting (XSS) vulnerabilities in /bsms…4.8
• CVE-2022-32988Cross Site Scripting (XSS) vulnerability in router Asus DSL-…5.4
• CVE-2022-3299A vulnerability was found in Open5GS up to 2.4.10. It has be…6.5
• CVE-2022-32990An issue in gimp_layer_invalidate_boundary of GNOME GIMP 2.1…5.5
• CVE-2022-32991Web Based Quiz System v1.0 was discovered to contain a SQL i…8.8