CVE-2023-0493

🗓️ 26 Jan 2023 00:00:00Reported by @huntrdevType

cve🔗 web.nvd.nist.gov👁 59 Views🌐 WEB

Improper Neutralization of Special Elements in GitHub repo btcpayserver/btcpayserve

Reporter	Title	Published	Views	Family All 18
0day.today	BTCPay Server v1.7.4 - HTML Injection Vulnerability	5 Apr 202300:00	–	zdt
Huntr	Stored HTML Injection	20 Jan 202304:05	–	huntr
Circl	CVE-2023-0493	5 Apr 202300:00	–	circl
CNNVD	BTCPay Server 注入漏洞	26 Jan 202300:00	–	cnnvd
Cvelist	CVE-2023-0493 Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver	26 Jan 202300:00	–	cvelist
Exploit DB	BTCPay Server v1.7.4 - HTML Injection	5 Apr 202300:00	–	exploitdb
EUVD	EUVD-2023-0312	3 Oct 202520:07	–	euvd
Github Security Blog	Withdrawn Advisory: HTML injections in BTCPayServer	27 Jan 202300:30	–	github
GitLab Advisory Database	Improper Neutralization of Equivalent Special Elements	27 Jan 202300:00	–	gitlab
NVD	CVE-2023-0493	26 Jan 202323:15	–	nvd

NVD

Node

btcpayserver btcpay_serverRange<1.7.5

[
  {
    "defaultStatus": "unaffected",
    "product": "btcpayserver/btcpayserver",
    "vendor": "btcpayserver",
    "versions": [
      {
        "lessThan": "1.7.5",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.dev/bounties/3a73b45c-6f3e-4536-a327-cdfdbc59896f
github	www.github.com/btcpayserver/btcpayserver/pull/4545/commits/02070d65836cd24627929b3403efbae8de56039a
packetstormsecurity	www.packetstormsecurity.com/files/171732/BTCPay-Server-1.7.4-HTML-Injection.html

Parameter	Position	Path	Description	CWE
label	request body	target-website.com/register	HTML injection vulnerability described via HTML in API key label field leading to rendering on deletion. Attack vector references the register endpoint and API key creation flow.	CWE-74, CWE-76

21 Nov 2024 07:37Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.15.3 - 8.8

EPSS0.0999

SSVC