CVE-2023-53899mediumCWE-918

CVE-2023-53899: falha de média gravidade em PodcastGenerator

PodcastGenerator 3.2.9 Blind Server-Side Request Forgery via XML Injection

Publicada em · Atualizada em

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.1epss 0.6%
probabilidade de exploração
0.6%top 55% das CVEs
exploração observada
nãonenhuma fonte reporta
PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload form. Attackers can manipulate the 'shortdesc' parameter to trigger external HTTP requests to arbitrary endpoints during podcast episode creation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Produtos afetados
Podcastgenerator · PodcastGenerator
CVEs relacionadas — PodcastGenerator

No mesmo produto, das mais perigosas para as menos.

CVE-2023-53918MEDIUMPodcastGenerator Stored Cross-Site Scripting via Episode Title FieldEPSS 0.3%CVE-2023-53920MEDIUMPodcastGenerator Stored Cross-Site Scripting via Podcast Title FieldEPSS 0.3%CVE-2023-53919MEDIUMPodcastGenerator Stored Cross-Site Scripting via Freebox Content FieldEPSS 0.3%
Referências
https://github.com/PodcastGenerator/PodcastGeneratorhttps://podcastgenerator.net/https://www.exploit-db.com/exploits/51565https://www.vulncheck.com/advisories/podcastgenerator-blind-server-side-request-forgery-via-xml-injection