GHSA-8p2p-p8mg-x3cw

Insight API transaction broadcast endpoint can result in Full Path Disclosure

Source: GitHub Advisory Database (reviewed) Moderate CVE-2018-1000023

Packages

Ecosystem	Package	Affected	Fixed in
npm	insight-api	<= 5.0.0	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Bitpay/insight-api Insight-api version 5.0.0 and earlier contains a CWE-20: input validation vulnerability in transaction broadcast endpoint that can result in Full Path Disclosure. This attack appear to be exploitable via Web request.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000023 advisory
https://github.com/bitpay/insight-api/issues/542 web
https://github.com/advisories/GHSA-8p2p-p8mg-x3cw advisory
https://github.com/bitpay/insight-api package