CVE-2023-0493 - OpenCVE

Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Btcpayserver	Btcpay Server

Configuration 1 [-]

cpe:2.3:a:btcpayserver:btcpay_server:*:*:*:*:*:*:*:*

References

Link	Resource
http://packetstormsecurity.com/files/171732/BTCPay-Server-1.7.4-HTML-Injection.html	Third Party Advisory VDB Entry
https://github.com/btcpayserver/btcpayserver/pull/4545/commits/02070d65836cd24627929b3403efbae8de56039a	Patch
https://huntr.dev/bounties/3a73b45c-6f3e-4536-a327-cdfdbc59896f	Exploit Patch Third Party Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: @huntrdev

Published: 2023-01-26T00:00:00

Updated: 2023-10-10T07:22:20.882Z

Reserved: 2023-01-25T00:00:00

Link: CVE-2023-0493

JSON object: View

NVD Information

Status : Analyzed

Published: 2023-01-26T23:15:15.920

Modified: 2023-10-31T16:03:55.190

Link: CVE-2023-0493

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:btcpayserver:btcpay_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "10680F85-A173-4539-965D-2181DC3C4347", "versionEndExcluding": "1.7.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.\n\n"}, {"lang": "es", "value": "Neutralizaci\u00f3n incorrecta de elementos especiales equivalentes en el repositorio de GitHub btcpayserver/btcpayserver antes de 1.7.5."}], "id": "CVE-2023-0493", "lastModified": "2023-10-31T16:03:55.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@huntr.dev", "type": "Secondary"}]}, "published": "2023-01-26T23:15:15.920", "references": [{"source": "security@huntr.dev", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://packetstormsecurity.com/files/171732/BTCPay-Server-1.7.4-HTML-Injection.html"}, {"source": "security@huntr.dev", "tags": ["Patch"], "url": "https://github.com/btcpayserver/btcpayserver/pull/4545/commits/02070d65836cd24627929b3403efbae8de56039a"}, {"source": "security@huntr.dev", "tags": ["Exploit", "Patch", "Third Party Advisory"], "url": "https://huntr.dev/bounties/3a73b45c-6f3e-4536-a327-cdfdbc59896f"}], "sourceIdentifier": "security@huntr.dev", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-76"}], "source": "security@huntr.dev", "type": "Secondary"}]}