CVE-2023-0493

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-0493
Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
http://packetstormsecurity.com/files/171732/BTCPay-Server-1.7.4-HTML-Injection.html Third Party Advisory VDB Entry
https://github.com/btcpayserver/btcpayserver/pull/4545/commits/02070d65836cd24627929b3403efbae8de56039a Patch
https://huntr.dev/bounties/3a73b45c-6f3e-4536-a327-cdfdbc59896f Exploit Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:btcpayserver:btcpay_server:*:*:*:*:*:*:*:*
History

31 Oct 2023, 16:03

Type Values Removed Values Added
CWE CWE-76 CWE-74
References (MISC) http://packetstormsecurity.com/files/171732/BTCPay-Server-1.7.4-HTML-Injection.html - (MISC) http://packetstormsecurity.com/files/171732/BTCPay-Server-1.7.4-HTML-Injection.html - Third Party Advisory, VDB Entry
References (MISC) https://github.com/btcpayserver/btcpayserver/pull/4545/commits/02070d65836cd24627929b3403efbae8de56039a - (MISC) https://github.com/btcpayserver/btcpayserver/pull/4545/commits/02070d65836cd24627929b3403efbae8de56039a - Patch

10 Oct 2023, 08:15

Type Values Removed Values Added
Summary Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5. Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.
References
  • {'url': 'https://github.com/btcpayserver/btcpayserver/commit/02070d65836cd24627929b3403efbae8de56039a', 'name': 'https://github.com/btcpayserver/btcpayserver/commit/02070d65836cd24627929b3403efbae8de56039a', 'tags': ['Patch', 'Third Party Advisory'], 'refsource': 'MISC'}
  • (MISC) https://github.com/btcpayserver/btcpayserver/pull/4545/commits/02070d65836cd24627929b3403efbae8de56039a -

06 Apr 2023, 17:15

Type Values Removed Values Added
References
  • (MISC) http://packetstormsecurity.com/files/171732/BTCPay-Server-1.7.4-HTML-Injection.html -

03 Feb 2023, 14:24

Type Values Removed Values Added
References (CONFIRM) https://huntr.dev/bounties/3a73b45c-6f3e-4536-a327-cdfdbc59896f - (CONFIRM) https://huntr.dev/bounties/3a73b45c-6f3e-4536-a327-cdfdbc59896f - Exploit, Patch, Third Party Advisory
References (MISC) https://github.com/btcpayserver/btcpayserver/commit/02070d65836cd24627929b3403efbae8de56039a - (MISC) https://github.com/btcpayserver/btcpayserver/commit/02070d65836cd24627929b3403efbae8de56039a - Patch, Third Party Advisory
CPE cpe:2.3:a:btcpayserver:btcpay_server:*:*:*:*:*:*:*:*
First Time Btcpayserver
Btcpayserver btcpay Server
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8

26 Jan 2023, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-01-26 23:15

Updated : 2023-12-10 14:48

NVD link : CVE-2023-0493

Mitre link : CVE-2023-0493

CVE.ORG link : CVE-2023-0493

JSON object : View

Products Affected

btcpayserver

  • btcpay_server
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-76

Improper Neutralization of Equivalent Special Elements