CVE-2020-25787

Опубликовано: 19 сент. 2020

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Средний

Описание

An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. It does not validate all URLs before requesting them.

Ссылки

http://packetstormsecurity.com/files/161606/TinyTinyRSS-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
https://blog.neagaru.com/p/exploiting-tiny-tiny-rss-2020
https://community.tt-rss.org/t/heads-up-several-vulnerabilities-fixed/3799
Vendor Advisory
https://git.tt-rss.org/fox/tt-rss/commit/c3d14e1fa54c7dade7b1b7955575e2991396d7ef
Patch
Vendor Advisory
http://packetstormsecurity.com/files/161606/TinyTinyRSS-Remote-Code-Execution.html
Exploit
Third Party Advisory
VDB Entry
https://community.tt-rss.org/t/heads-up-several-vulnerabilities-fixed/3799
Vendor Advisory
https://git.tt-rss.org/fox/tt-rss/commit/c3d14e1fa54c7dade7b1b7955575e2991396d7ef
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:tt-rss:tiny_tiny_rss:*:*:*:*:*:*:*:*

Версия до 2020-09-16 (исключая)

EPSS

Процентиль: 94%

0.13768

Средний

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-20

Связанные уязвимости

CVE-2020-25787

CVSS3: 9.8

ubuntu

больше 5 лет назад

An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. It does not validate all URLs before requesting them.

CVE-2020-25787

CVSS3: 9.8

debian

больше 5 лет назад

An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-1 ...

GHSA-8966-pp95-9j6j

CVSS3: 9.8

github

больше 3 лет назад

An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. It does not validate all URLs before requesting them.

EPSS

Процентиль: 94%

0.13768

Средний

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-20