CVE-2023-22481
- Source
- https://cve.org/CVERecord?id=CVE-2023-22481
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-22481.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2023-22481
- Aliases
-
- GHSA-8vvv-jxg6-8578
- Published
- 2023-03-06T17:33:03.697Z
- Modified
- 2025-11-29T13:54:32.749583Z
- Severity
-
- 4.0 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- Sensitive information exposure in the logs of greader API in FreshRSS
- Details
-
FreshRSS is a self-hosted RSS feed aggregator. When using the greader API, the provided password is logged in clear in
users/_/log_api.txtin the case where the authentication fails. The issues occurs inauthorizationToUser()ingreader.php. If there is an issue with the request or the credentials,unauthorized()orbadRequest()is called. Both these functions are printing the return ofdebugInfo()in the logs.debugInfo()will return the content of the request. By default, this will be saved inusers/_/log_api.txtand if the constCOPY_LOG_TO_SYSLOGis true, in syslogs as well. Exploiting this issue requires having access to logs produced by FreshRSS. Using the information from the logs, a malicious individual could get users' API keys (would be displayed if the users fills in a bad username) or passwords. - Database specific
{ "cna_assigner": "GitHub_M", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22481.json", "cwe_ids": [ "CWE-532" ] }- References