CVE-2023-0493
Published: 26 January 2023
Summary
CVE-2023-0493 is a medium-severity Improper Neutralization of Equivalent Special Elements (CWE-76) vulnerability in Btcpayserver Btcpay Server. Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 6.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
CVE-2023-0493 is an improper neutralization of equivalent special elements vulnerability present in the btcpayserver/btcpayserver GitHub repository prior to version 1.7.5. The flaw is also referenced under CWEs 76 and 74 and carries a CVSS 3.1 base score of 5.3 reflecting network attack vector, low complexity, and no required privileges or user interaction, with impact limited to partial availability loss.
An unauthenticated remote attacker can supply crafted input that is not properly sanitized, resulting in HTML injection that may degrade service availability. Public references explicitly label the issue as HTML injection in BTCPay Server 1.7.4 and earlier.
The referenced GitHub pull request and associated commit neutralize the special elements responsible for the injection. The fix is included in the 1.7.5 release, and the issue was tracked through a huntr.dev bounty submission.
EPSS for the CVE has remained flat at 0.0999 with no material rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-0312
Vulnerability details
Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.