CVE-2023-50258

🗓️ 22 Dec 2023 16:55:58Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 40 Views🌐 WEB

Medusa automatic video library manager for TV shows vulnerable to unauthenticated blind SSRF in versions prior to 1.0.19 fi

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2023-50258	22 Dec 202318:23	–	circl
CNNVD	Medusa Code Issues Vulnerabilities	22 Dec 202300:00	–	cnnvd
Cvelist	CVE-2023-50258 Blind SSRF in `/home/testdiscord` endpoint	22 Dec 202316:55	–	cvelist
EUVD	EUVD-2023-55072	3 Oct 202520:07	–	euvd
NVD	CVE-2023-50258	22 Dec 202317:15	–	nvd
Prion	Server side request forgery (ssrf)	22 Dec 202317:15	–	prion
Positive Technologies	PT-2023-31512 · Medusa · Medusa	22 Dec 202300:00	–	ptsecurity
RedhatCVE	CVE-2023-50258	23 May 202502:48	–	redhatcve
Vulnrichment	CVE-2023-50258 Blind SSRF in `/home/testdiscord` endpoint	22 Dec 202316:55	–	vulnrichment

NVD

Vulners

Node

pymedusa medusaRange<1.0.19

[
  {
    "vendor": "pymedusa",
    "product": "Medusa",
    "versions": [
      {
        "version": "< 1.0.19",
        "status": "affected"
      }
    ]
  }
]

Source	Link
securitylab	www.securitylab.github.com/advisories/GHSL-2023-201_GHSL-2023-202_Medusa/
github	www.github.com/pymedusa/Medusa/blob/3d656652ab277e47689483912ed7fc443e7023e8/medusa/server/web/home/handler.py
github	www.github.com/pymedusa/Medusa/security/advisories/GHSA-3hph-6586-qv9g
github	www.github.com/pymedusa/Medusa/releases/tag/v1.0.19
github	www.github.com/pymedusa/Medusa/blob/3d656652ab277e47689483912ed7fc443e7023e8/medusa/notifiers/discord.py

Parameter	Position	Path	Description	CWE
discord_webhook	request body	medusa/server/web/home/handler.py	Unauthenticated SSRF via user-controlled discord_webhook that is forwarded to Discord notifier, allowing server-side requests to arbitrary URLs.	CWE-918

17 Jun 2026 06:39Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.15.3

EPSS0.00693

SSVC

CWE-918