PT-2025-14783 · Miniflux · Miniflux

Publicado 2025-04-03 · Atualizado 2025-04-10 · CVE-2025-31483

Positive Technologies (AI Summary)

CVSS v4.0

4.8

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Miniflux versions prior to 2.2.7

Description The issue is related to a weak Content Security Policy on the "/proxy/*" route, allowing an attacker to bypass the CSP of the media proxy and execute cross-site scripting when opening external images in a new tab or window.

Recommendations For versions prior to 2.2.7, update to version 2.2.7 to fix the vulnerability. As a temporary workaround, consider changing the Content Security Policy for the media proxy to "default-src 'none'; form-action 'none'; sandbox;" to mitigate the risk of exploitation. Restrict access to the "/proxy/*" route to minimize the risk of cross-site scripting attacks.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-31483

GHSA-CQ88-842X-2JHP

GO-2025-3591

OPENSUSE-SU-2025:14982-1

Produtos afetados

Miniflux

Referências · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/31xxx/CVE-2025-31483.json · Exploit
• https://github.com/miniflux/v2 · Nota
• https://github.com/miniflux/v2/security/advisories/GHSA-cq88-842x-2jhp · Nota
• https://github.com/miniflux/v2/commit/cb695e653a08af4cabcb277c271ce74bd0c746e6 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-31483 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2025-32025 · Nota
• https://suse.com/security/cve/CVE-2025-32024 · Nota
• https://osv.dev/vulnerability/GHSA-cq88-842x-2jhp · Aviso do Fabricante
• https://t.me/cvedetector/22005 · Publicação no Telegram
• https://suse.com/security/cve/CVE-2025-31489 · Nota
• https://twitter.com/VulmonFeeds/status/1907978735912948018 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2025-31483 · Nota
• https://cve.org/CVERecord?id=CVE-2025-31483 · Nota de Segurança
• https://ubuntu.com/security/CVE-2025-31483 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2025-31483 · Aviso do Fabricante