Medium · 5.3 CVE-2018-1000023 EUVD-2018-0177GHSA-8p2p-p8mg-x3cw

Insight API transaction broadcast endpoint can result in Full Path Disclosure

Published Feb 9, 2018 · Updated Aug 5, 2024 · Assigned by mitre

Description

Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint that can result in Full Path Disclosure. This attack appear to be exploitable via Web request.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
npm	insight-api	<= 5.0.0	—	GHSA-8p2p-p8mg-x3cw

References

https://github.com/bitpay/insight-api/issues/542