CVE-2023-22493

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. An attacker can exploit this vulnerability by sending a request to the affected routes with a malicious URL. An attacker could also use this vulnerability to send requests to internal or any other servers or resources on the network, potentially gain access to sensitive information that would not normally be accessible and amplifying the impact of the attack. The patch for this issue can be found in commit a66cbcf.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

VendorProductVersions
DIYgodRSSHub< 1.0.0-master.a66cbcf

References

Timeline

Published
Jan 13, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-224959.8Izanami is a shared configuration service well-suited for micro-service architecture implementation. Attackers can bypass the authenticationCVE-2023-224969.8Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the ability to establish a stCVE-2023-224979.1Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. Each Netdata Agent has an automatically generaCVE-2023-224997.5Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Multi-threaded programs were able to spoof interactive peCVE-2023-22506.7A flaw was found in the Open Cluster Management (OCM) when a user have access to the worker nodes which has the cluster-manager-registrationCVE-2023-225007.5GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6 are vulnerable to Incorrect AuthorizatioCVE-2023-225019.1An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate anoCVE-2023-225035.3Affected versions of Atlassian Confluence Server and Data Center allow anonymous remote attackers to view the names of attachments and labelCVE-2023-225046.5Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not write permissions, to uCVE-2023-225058.8This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22505 was introduced in version 8.0.0 of Confluence Data CentCVE-2023-225068.8This High severity Injection and RCE (Remote Code Execution) vulnerability known as CVE-2023-22506 was introduced in version 8.0.0 of BambooCVE-2023-225088.8This High severity RCE (Remote Code Execution) vulnerability known as CVE-2023-22508 was introduced in version 6.1.0 of Confluence Data Cent