PT-2023-23502 · Owncast · Owncast

Gabek · CVE-2023-3188 · Published 2023-06-10 · Updated 2023-06-16

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions owncast/owncast versions prior to 0.1.0

Description The issue is related to Server-Side Request Forgery (SSRF) in the owncast/owncast GitHub repository. This allows an attacker to make requests to internal services that are not intended for external access.

Recommendations For versions prior to 0.1.0, update to version 0.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to internal services to minimize the risk of exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-3188

Affected Products

Owncast

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3188.json · Exploit
• 🔥 https://huntr.dev/bounties/0d0d526a-1c39-4e6a-b081-d3914468e495 · Exploit
• https://github.com/owncast/owncast/commit/f40135dbf28093864482f9662c23e478ea192b16 · Patch
• https://osv.dev/vulnerability/CVE-2023-3188 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3188 · Security Note
• https://t.me/cibsecurity/65120 · Telegram Post