What is CVE-2023-24060?

CVE-2023-24060 is a medium-severity vulnerability in Havenweb Haven, classified under Server-Side Request Forgery (SSRF). CVSS score: 5.0/10. Published 2023-01-27.

How severe is CVE-2023-24060?

Medium severity. CVSS v3 base score is 5.0 out of 10.

SSRF in Havenweb Haven

CVE-2023-24060

Haven 5d15944 allows Server-Side Request Forgery (SSRF) via the feed[url]= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname (or even the hostname of the Haven server itself). NOTE: this product has significant usage but does not have numbered releases; ordinary end users may typically use the master branch.

Vulnerability class: SSRF (Server-Side Request Forgery)

EPSS: 0.005 (38.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N.

Affected products

Havenweb Haven — versions 5d15944
N/a — versions n/a

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

cve@mitre.org (Product, Vendor Advisory)
cve@mitre.org (Exploit, Third Party Advisory, Issue Tracking)

Frequently asked questions

What is CVE-2023-24060?: CVE-2023-24060 is a medium-severity vulnerability in Havenweb Haven, classified under Server-Side Request Forgery (SSRF). CVSS score: 5.0/10. Published 2023-01-27.
How severe is CVE-2023-24060?: Medium severity. CVSS v3 base score is 5.0 out of 10.