CVE-2020-25788

Опубликовано: 19 сент. 2020

Источник: nvd

CVSS3: 8.1

CVSS2: 6.8

EPSS Низкий

Описание

An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. imgproxy in plugins/af_proxy_http/init.php mishandles $_REQUEST["url"] in an error message.

Ссылки

https://blog.neagaru.com/p/exploiting-tiny-tiny-rss-2020
https://community.tt-rss.org/t/heads-up-several-vulnerabilities-fixed/3799
Vendor Advisory
https://git.tt-rss.org/fox/tt-rss/commit/c3d14e1fa54c7dade7b1b7955575e2991396d7ef
Patch
Vendor Advisory
https://community.tt-rss.org/t/heads-up-several-vulnerabilities-fixed/3799
Vendor Advisory
https://git.tt-rss.org/fox/tt-rss/commit/c3d14e1fa54c7dade7b1b7955575e2991396d7ef
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:tt-rss:tiny_tiny_rss:*:*:*:*:*:*:*:*

Версия до 2020-09-16 (исключая)

EPSS

Процентиль: 69%

0.00619

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-829

Связанные уязвимости

CVE-2020-25788

CVSS3: 8.1

ubuntu

больше 5 лет назад

An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. imgproxy in plugins/af_proxy_http/init.php mishandles $_REQUEST["url"] in an error message.

CVE-2020-25788

CVSS3: 8.1

debian

больше 5 лет назад

An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-1 ...

GHSA-c9pq-99jp-354g

CVSS3: 8.1

github

больше 3 лет назад

An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16. imgproxy in plugins/af_proxy_http/init.php mishandles $_REQUEST["url"] in an error message.

EPSS

Процентиль: 69%

0.00619

Низкий

8.1 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-829