CVE-2023-53899mediumCWE-918

CVE-2023-53899: medium-severity vulnerability in PodcastGenerator

PodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injection

Published · Updated

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.6%
exploitation probability
0.6%top 55% of all CVEs
observed exploitation
nono source reports it
PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload form. Attackers can manipulate the 'shortdesc' parameter to trigger external HTTP requests to arbitrary endpoints during podcast episode creation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Affected products
Podcastgenerator · PodcastGenerator
Related CVEs — PodcastGenerator

In the same product, most dangerous first.

CVE-2023-53918MEDIUMPodcastGenerator Stored Cross-Site Scripting via Episode Title FieldEPSS 0.3%CVE-2023-53920MEDIUMPodcastGenerator Stored Cross-Site Scripting via Podcast Title FieldEPSS 0.3%CVE-2023-53919MEDIUMPodcastGenerator Stored Cross-Site Scripting via Freebox Content FieldEPSS 0.3%
References
https://github.com/PodcastGenerator/PodcastGeneratorhttps://podcastgenerator.net/https://www.exploit-db.com/exploits/51565https://www.vulncheck.com/advisories/podcastgenerator-blind-server-side-request-forgery-via-xml-injection