CVE-2023-22481: Sensitive information exposure in the logs of greader API in FreshRSS
FreshRSS is a self-hosted RSS feed aggregator. When using the greader API, the provided password is logged in clear in users//logapi.txt in the case where the authentication fails. The issues occurs in authorizationToUser() in greader.php. If there is an issue with the request or the credentials, unauthorized() or badRequest() is called. Both these functions are printing the return of debugInfo() in the logs. debugInfo() will return the content of the request. By default, this will be saved in users//logapi.txt and if the const COPYLOGTOSYSLOG is true, in syslogs as well. Exploiting this issue requires having access to logs produced by FreshRSS. Using the information from the logs, a malicious individual could get users' API keys (would be displayed if the users fills in a bad username) or passwords.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-22481?
CVE-2023-22481 is a vulnerability in FreshRSS where the provided password is logged in clear in log_api.txt when using the greader API.
What is the severity of CVE-2023-22481?
CVE-2023-22481 has a severity of medium with a CVSS score of 5.5.
How does CVE-2023-22481 affect FreshRSS?
CVE-2023-22481 affects FreshRSS versions between 1.9.0 and 1.21.0.
How can I fix CVE-2023-22481?
To fix CVE-2023-22481, update FreshRSS to a version above 1.21.0.
Is there any additional information about CVE-2023-22481?
Additional information about CVE-2023-22481 can be found at the following references: [GitHub Commit](https://github.com/FreshRSS/FreshRSS/commit/075cf4c800063e3cc65c3d41a9c23222e8ebb554) and [Security Advisories](https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-8vvv-jxg6-8578).