Skip to main content

Btcpay Server CVE-2023-1149

MEDIUM
Improper Neutralization of Equivalent Special Elements (CWE-76)
2023-03-02 security@huntr.dev
Information Disclosure Btcpay Server
5.4
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.4 MEDIUM
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

1
CVE Published
Mar 02, 2023 - 05:15 nvd
MEDIUM 5.4

DescriptionNVD

Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0.

AnalysisAI

Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-76. Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.8.0. Affected products include: Btcpayserver Btcpay Server. Version information: prior to 1.8.0..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Btcpay Server

View all
CVE-2023-0493 HIGH POC
8.8 Jan 26

Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5. Ra
CVE-2021-3646 MEDIUM POC
6.1 Sep 10

btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rate
CVE-2023-0879 MEDIUM POC
5.4 Feb 17

Cross-site Scripting (XSS) - Stored in GitHub repository btcpayserver/btcpayserver prior to 1.7.12. Rated medium severit
CVE-2021-3830 MEDIUM POC
5.4 Sep 26

btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Rate
CVE-2021-29249 HIGH
7.5 Mar 26

BTCPay Server before 1.0.6.0, when the payment button is used, has a privacy vulnerability. Rated high severity (CVSS 7.
CVE-2021-29246 MEDIUM
6.7 May 05

BTCPay Server through 1.0.7.0 suffers from directory traversal, which allows an attacker with admin privileges to achiev
CVE-2021-29251 MEDIUM
6.5 Apr 01

BTCPay Server before 1.0.7.1 mishandles the policy setting in which users can register (in Server Settings > Policies).

CVE-2021-29250 MEDIUM
5.4 May 05

BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting (XSS) vulnerability within the POS Add Products
CVE-2021-29248 MEDIUM
5.3 May 05

BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set th
CVE-2021-29247 MEDIUM
5.3 May 05

BTCPay Server through 1.0.7.0 could allow a remote attacker to obtain sensitive information, caused by failure to set th
CVE-2021-29245 MEDIUM
5.3 May 05

BTCPay Server through 1.0.7.0 uses a weak method Next to produce pseudo-random values to generate a legacy API key. Rate

Same weakness CWE-76 – Improper Neutralization of Equivalent Special Elements

View all
CVE-2024-2952 CRITICAL POC
9.8
CVE-2023-0493 HIGH POC
8.8
CVE-2024-4897 HIGH POC
8.4
CVE-2024-34359 CRITICAL
9.6
CVE-2026-55723 HIGH
8.7
CVE-2026-11311 HIGH
8.6
CVE-2024-1882 HIGH
7.2
CVE-2024-1883 MEDIUM
6.1

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2023-1149 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy