CVE-2023-24060

Haven 5d15944 allows Server-Side Request Forgery (SSRF) via the feed[url]= Feeds functionality

Medium · published January 27, 2023

CVSS v3.1
5.0
EPSS
0%
Percentile
40.4
In the wild
Unconfirmed
What it is

Haven 5d15944 allows Server-Side Request Forgery (SSRF) via the feed[url]= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname (or even the hostname of the Haven server itself). NOTE: this product has significant usage but does not have numbered releases; ordinary end users may typically use the master branch.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00480 · 40.4th percentile
Published
2023-01-27T00:00Z
EPSS history
Timeline
  • 27 JAN 00:00Z
    Haven 5d15944 allows Server-Side Request Forgery (SSRF) via the feed[url]= Feeds functionality
    cvelistv5