PT-2022-16030 · Freshrss · Freshrss

C3L3Si4N · Published 2022-12-09 · Updated 2022-12-13 · CVE-2022-23497

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions FreshRSS versions prior to 1.20.2

Description FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords of the FreshRSS Web interface. If the API is used, the configuration might contain a hashed password of the GReader API, and a hashed password of the Fever API.

Recommendations For versions prior to 1.20.2, update to version 1.20.2 or edge. For users unable to upgrade, apply the patch manually or delete the file ./FreshRSS/p/ext.php.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-23497

GHSA-HVRJ-5FWJ-P7V6

Affected Products

Freshrss

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23497.json · Exploit
• https://github.com/FreshRSS/FreshRSS/releases/tag/1.20.2 · Patch
• https://github.com/FreshRSS/FreshRSS/pull/4928 · Patch
• https://osv.dev/vulnerability/CVE-2022-23497 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23497 · Security Note
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-hvrj-5fwj-p7v6 · Note
• https://t.me/cvenotify/39569 · Telegram Post