Lucene search

GoogleOSV:CVE-2022-23497

HistoryDec 09, 2022 - 11:15 p.m.

CVE-2022-23497

2022-12-0923:15:11

Google

osv.dev

freshrss

remote access

vulnerability

hashed passwords

configuration

api

update

patch

software

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.1 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

66.1%

JSON

FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords (brypt with cost 9, salted) of FreshRSS Web interface. If the API is used, the configuration might contain a hashed password (brypt with cost 9, salted) of the GReader API, and a hashed password (MD5 salted) of the Fever API. Users should update to version 1.20.2 or edge. Users unable to upgrade can apply the patch manually or delete the file ./FreshRSS/p/ext.php.

CPENameOperatorVersion
freshrsseq1.20.1
freshrsseq1.18.1
freshrsseq1.20.0
freshrsseq1.18.0
freshrsseq1.19.0
freshrsseq1.19.1
freshrsseq1.19.2

Name	Operator	Version
freshrss	eq	1.20.1
freshrss	eq	1.18.1
freshrss	eq	1.20.0
freshrss	eq	1.18.0
freshrss	eq	1.19.0
freshrss	eq	1.19.1
freshrss	eq	1.19.2

References

github.com/FreshRSS/FreshRSS/pull/4928

github.com/FreshRSS/FreshRSS/releases/tag/1.20.2

github.com/FreshRSS/FreshRSS/security/advisories/GHSA-hvrj-5fwj-p7v6

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.1 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

66.1%

JSON

Related for OSV:CVE-2022-23497