CVE-2023-22493: high-severity vulnerability in DIYgod RSSHub
RSSHub is vulnerable to SSRF (Server-Side Request Forgery)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.8%
RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. An attacker can exploit this vulnerability by sending a request to the affected routes with a malicious URL. An attacker could also use this vulnerability to send requests to internal or any other servers or resources on the network, potentially gain access to sensitive information that would not normally be accessible and amplifying the impact of the attack. The patch for this issue can be found in commit a66cbcf.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Affected products
DIYgod · RSSHubRelated CVEs — DIYgod RSSHub
In the same product, most dangerous first.
CVE-2021-21278HIGHRisk of code injection in RSSHubEPSS 1.6%CVE-2022-31110MEDIUMDenial of Service (DoS) vulnerability in RSSHubEPSS 1.6%CVE-2024-27927MEDIUMRSSHub vulnerable to SSRF in /mastodon, /zjoi, and /m4EPSS 1.0%CVE-2024-47179HIGHRSSHub's `docker-test-cont.yml` workflow is vulnerable to Artifact Poisoning which may lead to a full repository takeover.EPSS 0.7%CVE-2024-27926MEDIUMRSSHub Cross-site Scripting vulnerability caused by internal media proxyEPSS 0.5%CVE-2023-26491MEDIUMRSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parametersEPSS 0.4%