CVE-2022-23497

    Dashboard / Vulnerabilities / CVE-2022-23497

    CVE-2022-23497

    Published: 9 Dec 2022Last Modified: 12 Aug 2026

    Summary: Insecure file access in FreshRSS

    Details: FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords (brypt with cost 9, salted) of FreshRSS Web interface. If the API is used, the configuration might contain a hashed password (brypt with cost 9, salted) of the GReader API, and a hashed password (MD5 salted) of the Fever API. Users should update to version 1.20.2 or edge. Users unable to upgrade can apply the patch manually or delete the file `./FreshRSS/p/ext.php`.

    References: https://github.com/FreshRSS/FreshRSS/releases/tag/1.20.2, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23497.json, https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-hvrj-5fwj-p7v6, https://nvd.nist.gov/vuln/detail/CVE-2022-23497, https://github.com/FreshRSS/FreshRSS/pull/4928

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 769f34e958b50e748acf6a151805f4a255df2043
    Fixed -27b71ffa99f7dff013fb8d51d020ed628e0d2ce6

    Affected versions

    1.20.1
    1.20.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-23497 | CVE-DB