CVE-2023-27592
1 advisory.
Go/miniflux.app/v2 CVE-2023-27592: medium 4.8, EPSS 0.59%
Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler
Action: Upgrade miniflux.app/v2 to 2.0.43 or later.
go get miniflux.app/v2@v2.0.43Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0.25 | 2.0.43 | - |
Fixed versions
| 2.0.43 |
Sources
- osv: GHSA-mqqg-xjhj-wfgw
- https://github.com/miniflux/v2/security/advisories/GHSA-mqqg-xjhj-wfgw
- https://nvd.nist.gov/vuln/detail/CVE-2023-27592
- https://github.com/miniflux/v2/pull/1746
- https://github.com/miniflux/v2
- https://github.com/miniflux/v2/blob/b2fd84e0d376a3af6329b9bb2e772ce38a25c31c/ui/proxy.go#L76
- https://github.com/miniflux/v2/blob/b2fd84e0d376a3af6329b9bb2e772ce38a25c31c/ui/proxy.go#L90
- https://github.com/miniflux/v2/releases/tag/2.0.25
- https://github.com/miniflux/v2/releases/tag/2.0.43
- https://miniflux.app/docs/configuration.html#proxy-images
CVE-2023-27592 · published · modified · JSON