CVE-2022-31110: fallo de gravedad media en DIYgod RSSHub
Denial of Service (DoS) vulnerability in RSSHub
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 1.6%
RSSHub is an open source, extensible RSS feed generator. In commits prior to 5c4177441417 passing some special values to the `filter` and `filterout` parameters can cause an abnormally high CPU. This results in an impact on the performance of the servers and RSSHub services which may lead to a denial of service. This issue has been fixed in commit 5c4177441417 and all users are advised to upgrade. There are no known workarounds for this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Productos afectados
DIYgod · RSSHubCVEs relacionadas — DIYgod RSSHub
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-21278HIGHRisk of code injection in RSSHubEPSS 1.6%CVE-2024-27927MEDIUMRSSHub vulnerable to SSRF in /mastodon, /zjoi, and /m4EPSS 1.0%CVE-2023-22493HIGHRSSHub is vulnerable to SSRF (Server-Side Request Forgery)EPSS 0.8%CVE-2024-47179HIGHRSSHub's `docker-test-cont.yml` workflow is vulnerable to Artifact Poisoning which may lead to a full repository takeover.EPSS 0.7%CVE-2024-27926MEDIUMRSSHub Cross-site Scripting vulnerability caused by internal media proxyEPSS 0.5%CVE-2023-26491MEDIUMRSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parametersEPSS 0.4%