CVE-2025-68148mediumCWE-770

CVE-2025-68148: falha de média gravidade em FreshRSS

FreshRSS globally denies access to feed via proxy modifying to 429 Retry-After

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar FreshRSS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.3epss 0.5%
FreshRSS is a free, self-hostable RSS aggregator. From version 1.27.0 to before 1.28.0, An attacker could globally deny access to feeds via proxy modifying to 429 Retry-After for a large list of feeds on given instance, making it unusable for majority of users. This issue has been patched in version 1.28.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Produtos afetados
FreshRSS · FreshRSS
CVEs relacionadas — FreshRSS

No mesmo produto, das mais perigosas para as menos.

CVE-2025-54593HIGHFreshRSS is vulnerable to RCE attacks by authenticated adminEPSS 0.9%CVE-2022-23497MEDIUMInsecure file access in FreshRSSEPSS 0.9%CVE-2025-58173HIGHFreshRSS vulnerable to authenticated RCE via path traversal inside include()EPSS 0.7%CVE-2025-68932LOWFreshRSS has weak cryptographic randomness in remember-me token and nonce generationEPSS 0.6%CVE-2025-54875CRITICALFreshRSS: Unauthorized creation of admin user when registration is enabledEPSS 0.5%CVE-2025-54592HIGHFreshRSS has Incomplete Session Termination on LogoutEPSS 0.5%