What is CVE-2023-24060?

CVE-2023-24060 is a medium-severity vulnerability in Havenweb Haven, classified under Server-Side Request Forgery (SSRF). CVSS score: 5.0/10. Published 2023-01-27.

How severe is CVE-2023-24060?

Medium severity. CVSS v3 base score is 5.0 out of 10.

SSRF in Havenweb Haven

CVE-2023-24060

Haven 5d15944 allows Server-Side Request Forgery (SSRF) via the feed[url]= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname (or even the hostname of the Haven server itself). NOTE: this product has significant usage but does not have numbered releases; ordinary end users may typically use the master branch.

Vulnerability class: SSRF (Server-Side Request Forgery)

Published 2023-01-27 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N.

EPSS exploit prediction

EPSS: 0.005 (39.1th percentile), scored 2026-10-02.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 39.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: 0.000

Affected products

Havenweb Haven — versions 5d15944

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

havenweb.org/ (Product, Vendor Advisory)
github.com/havenweb/haven/issues/51 (Exploit, Third Party Advisory, Issue Tracking)

Frequently asked questions

What is CVE-2023-24060?: CVE-2023-24060 is a medium-severity vulnerability in Havenweb Haven, classified under Server-Side Request Forgery (SSRF). CVSS score: 5.0/10. Published 2023-01-27.
How severe is CVE-2023-24060?: Medium severity. CVSS v3 base score is 5.0 out of 10.