An issue was discovered in Xuperchain 3.6.0 that allows for attackers to recover any arbitrary users private key after obtaining the partial signature in multisignature.
Weakness
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Xuperchain | Baidu | 3.6.0 (including) | 3.6.0 (including) |