CVE-2023-22493: fallo de gravedad alta en DIYgod RSSHub
RSSHub is vulnerable to SSRF (Server-Side Request Forgery)
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.8epss 0.8%
RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. An attacker can exploit this vulnerability by sending a request to the affected routes with a malicious URL. An attacker could also use this vulnerability to send requests to internal or any other servers or resources on the network, potentially gain access to sensitive information that would not normally be accessible and amplifying the impact of the attack. The patch for this issue can be found in commit a66cbcf.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Productos afectados
DIYgod · RSSHubCVEs relacionadas — DIYgod RSSHub
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-21278HIGHRisk of code injection in RSSHubEPSS 1.6%CVE-2022-31110MEDIUMDenial of Service (DoS) vulnerability in RSSHubEPSS 1.6%CVE-2024-27927MEDIUMRSSHub vulnerable to SSRF in /mastodon, /zjoi, and /m4EPSS 1.0%CVE-2024-47179HIGHRSSHub's `docker-test-cont.yml` workflow is vulnerable to Artifact Poisoning which may lead to a full repository takeover.EPSS 0.7%CVE-2024-27926MEDIUMRSSHub Cross-site Scripting vulnerability caused by internal media proxyEPSS 0.5%CVE-2023-26491MEDIUMRSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parametersEPSS 0.4%