---
cve: "CVE-2022-23497"
severity: "MEDIUM"
cvss: 6.5
epss: "84%"
vendor: "FreshRSS"
kev: false
exploited: false
published: "2022-12-09 23:15:11"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-09-14T16:54:47+02:00"
---

# CVE-2022-23497

> 6.5 MEDIUM · 🧪 PoC

## Beschreibung

FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords (brypt with cost 9, salted) of FreshRSS Web interface. If the API is used, the configuration might contain a hashed password (brypt with cost 9, salted) of the GReader API, and a hashed password (MD5 salted) of the Fever API. Users should update to version 1.20.2 or edge. Users unable to upgrade can apply the patch manually or delete the file `./FreshRSS/p/ext.php`.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Gering | warn |
| I Integrität | Keine | good |
| A Verfügbarkeit | Gering | warn |

## Patch verfügbar (OSV)

- 27b71ffa99f7dff013fb8d51d020ed628e0d2ce6 (Commit)

## Referenzen

- <https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-hvrj-5fwj-p7v6>
- <https://github.com/FreshRSS/FreshRSS/pull/4928>
- <https://github.com/FreshRSS/FreshRSS/releases/tag/1.20.2>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2022-23497) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_