CVE-2023-47619: Audiobookshelf Server-Side Request Forgery and Arbitrary File Read Vulnerability
Audiobookshelf is a self-hosted audiobook and podcast server. In versions 2.4.3 and prior, users with the update permission are able to read arbitrary files, delete arbitrary files and send a GET request to arbitrary URLs and read the response. This issue may lead to Information Disclosure. As of time of publication, no patches are available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-47619?
CVE-2023-47619 is considered a moderate severity vulnerability due to its potential to expose sensitive information and allow arbitrary file access.
How do I fix CVE-2023-47619?
To fix CVE-2023-47619, upgrade your Audiobookshelf installation to version 2.4.4 or later.
What versions of Audiobookshelf are affected by CVE-2023-47619?
CVE-2023-47619 affects all versions of Audiobookshelf prior to 2.4.4.
What actions can users with update permissions take in CVE-2023-47619?
Users with update permissions can read, delete arbitrary files, and make GET requests to arbitrary URLs due to CVE-2023-47619.
What are the potential impacts of exploiting CVE-2023-47619?
Exploiting CVE-2023-47619 may lead to information disclosure and unauthorized access to sensitive data on the server.