GitHub Advisoryadvisory · npm

GHSA-8p2p-p8mg-x3cw Insight API transaction broadcast endpoint can result in Full Path Disclosure

MEDIUM Published 2018-03-05 Modified 2022-04-25 Official page ↗
Aliases
CVE-2018-1000023
Ecosystem
npm
Packages
insight-api
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-20
Reviewed
2020-06-16

Affected packages

• npm insight-api: <= 5.0.0 (no fix yet)

Description

Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint that can result in Full Path Disclosure. This attack appear to be exploitable via Web request.

Related

Alias · CVE (1)

  • CVE-2018-1000023 Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References