Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2022-23497: Insecure file access in FreshRSS
CVE-2022-23497 · published 3 years ago
Summary
FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords (brypt with cost 9, salted) of FreshRSS Web interface. If the API is used, the configuration might contain a hash...
What to do
- Update freshrss freshrss to version 1.20.2 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| freshrss | freshrss |
>= 1.18.0, < 1.20.2 cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:* |
Original advisory text
Insecure file access in FreshRSS
FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords (brypt with cost 9, salted) of FreshRSS Web interface. If the API is used, the configuration might contain a hashed password (brypt with cost 9, salted) of the GReader API, and a hashed password (MD5 salted) of the Fever API. Users should update to version 1.20.2 or edge. Users unable to upgrade can apply the patch manually or delete the file `./FreshRSS/p/ext.php`.
References
- https://github.com/FreshRSS/FreshRSS/releases/tag/1.20.2 URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23497... Vendor Advisory
- https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-hvrj-5fwj-p7v6 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-23497 Vendor Advisory
- https://github.com/FreshRSS/FreshRSS/pull/4928 Patch
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
6.5
Medium
Type
CWE-200Information Exposure
Timeline
Published9 Dec 2022
Updated3 Nov 2026
First seen29 Sep 2026
Track software like this
Free during beta