CVE-2023-24060

2023-01-2700:00:00

mitre

www.cve.org

cve-2023-24060

server-side request forgery

ssrf

feeds functionality

authenticated users

rss feeds

arbitrary hostname

haven server

significant usage

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

23.5%

JSON

Haven 5d15944 allows Server-Side Request Forgery (SSRF) via the feed[url]= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname (or even the hostname of the Haven server itself). NOTE: this product has significant usage but does not have numbered releases; ordinary end users may typically use the master branch.

References

github.com/havenweb/haven/issues/51

havenweb.org/