bitpay/insight-api · Security
Insight API transaction broadcast endpoint can result in Full Path Disclosure
- GHSA ID
- GHSA-8p2p-p8mg-x3cw
- CVE ID
- CVE-2018-1000023
- Severity
- medium
- Published
- Updated
- CVSS
- 5.3 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS v3
- 5.3 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint that can result in Full Path Disclosure. This attack appear to be exploitable via Web request.
CWEs
- CWE-20 · Improper Input Validation