CVE-2023-47619CWE-200CWE-918

Audiobookshelf Server-Side Request Forgery and Arbitrary File Read Vulnerability

High · published December 13, 2023

CVSS v3.1
8.1
EPSS
1%
Percentile
48.4
In the wild
Unconfirmed
What it is

Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, users with the update permission are able to read arbitrary files, delete arbitrary files and send a GET request to arbitrary URLs and read the response. This issue may lead to Information Disclosure. As of time of publication, no patches are available.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00607 · 48.4th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2023-12-13T21:02Z
EPSS history
Timeline
  • 13 DEC 21:02Z
    Audiobookshelf Server-Side Request Forgery and Arbitrary File Read Vulnerability
    cvelistv5