PT-2023-31876 · Unknown · Audiobookshelf

Sylwia-Budzynska · CVE-2023-51665 · Publicado 2023-12-27 · Atualizado 2024-01-11

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Audiobookshelf versions prior to 2.7.0

Description Audiobookshelf is a self-hosted audiobook and podcast server. The issue is related to an unauthenticated blind server-side request (SSRF) vulnerability in Auth.js. This vulnerability has been addressed in version 2.7.0. There are no known workarounds for this issue.

Recommendations For versions prior to 2.7.0, update to version 2.7.0 to resolve the issue. As a temporary workaround, consider restricting access to the Auth.js module until the update is applied.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2023-51665

GHSA-GJGJ-98V3-47PG

Produtos afetados

Audiobookshelf

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51665.json · Exploit
• https://github.com/advplyr/audiobookshelf/security/advisories/GHSA-gjgj-98v3-47pg · Nota
• https://github.com/advplyr/audiobookshelf/commit/728496010cbfcee5b7b54001c9f79e02ede30d82 · Correção
• https://osv.dev/vulnerability/CVE-2023-51665 · Aviso do Fabricante
• https://twitter.com/GHSecurityLab/status/1745534546848759996 · Publicação no Twitter
• https://twitter.com/RedPacketSec/status/1740674633265824131 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1740094704241295669 · Publicação no Twitter
• https://t.me/cvenotify/66389 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-51665 · Nota de Segurança
• https://twitter.com/CVEnew/status/1740064482204725253 · Publicação no Twitter