CVE-2023-0493

Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver

Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.

Affected

btcpayserver · btcpayserver/btcpayserver

CVSS v3.1 NVD

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 HUNTR

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

7.90% chance of exploitation in the next 30 days, 95th percentile

Published

2023-01-26

Updated

2025-03-31

Proof-of-concept exploits (1)

• https://huntr.dev/bounties/3a73b45c-6f3e-4536-a327-cdfdbc59896f

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/51254

Security advisories

• http://packetstormsecurity.com/files/171732/BTCPay-Server-1.7.4-HTML-Injection.html
• btcpayserver/btcpayserver/pull/4545/commits/02070d65836cd24627929b3403efbae8de56039a

References

• CVE Record
• NVD entry