Lucene search

GitHub Advisory DatabaseGHSA-32GR-4CQ6-5W5Q

HistoryMar 01, 2023 - 6:02 p.m.

rsshub vulnerable to Cross-site Scripting via unvalidated URL parameters

2023-03-0118:02:28

CWE-79

GitHub Advisory Database

github.com

rsshub

cross-site scripting

url parameters

special characters

error page

xss vulnerabilities

arbitrary javascript code

version c910c4d28717fb860fbe064736641f379fab2c91

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

32.3%

JSON

Impact

When the URL parameters contain certain special characters, it returns an error page that does not properly handle XSS vulnerabilities, allowing for the execution of arbitrary JavaScript code.

Users who access the deliberately constructed URL are affected.

Patches

This vulnerability was fixed in version c910c4d28717fb860fbe064736641f379fab2c91. Please upgrade to this or a later version.

Workarounds

No.

Affected configurations

Vulners

Node

rsshubrsshubRange<1.0.0-master.c910c4dnode.js

CPENameOperatorVersion
rsshublt1.0.0-master.c910c4d

CPE	Name	Operator	Version
	rsshub	lt	1.0.0-master.c910c4d

References

github.com/advisories/GHSA-32gr-4cq6-5w5q

github.com/DIYgod/RSSHub/commit/c910c4d28717fb860fbe064736641f379fab2c91

github.com/DIYgod/RSSHub/security/advisories/GHSA-32gr-4cq6-5w5q

nvd.nist.gov/vuln/detail/CVE-2023-26491

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

32.3%

JSON

Related for GHSA-32GR-4CQ6-5W5Q