CVE-2018-1000023

EUVD-2018-0177
Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint that can result in Full Path Disclosure. This attack appear to be exploitable via Web request.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 45%
Affected Products (NVD)
VendorProductVersion
insight.bitpayinsight-api
𝑥
≤ 5.0.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/bitpay/insight-api/issues/542
https://github.com/bitpay/insight-api/issues/542