Information disclosure in Readtomyshoe Project
CVE-2023-27587
ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing sensitive information prior to commit 8533b01. If an error occurs when adding an article, the website shows the user an error message. If the error originates from the Google Cloud TTS request, then it will include the full URL of the request. The request URL contains the Google Cloud API key. This has been patched in commit 8533b01. Upgrading should be accompanied by deleting the current GCP API key and issuing a new one. There are no known workarounds.
EPSS: 0.039 (89.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N.
Affected products
- Readtomyshoe_project Readtomyshoe
- Rozbb Readtomyshoe — versions <= 0.2.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (Patch, Vendor Advisory)
- security-advisories@github.com (Patch)
Frequently asked questions
- What is CVE-2023-27587?
- CVE-2023-27587 is a high-severity vulnerability in Readtomyshoe Project, classified under Generation of Error Message Containing Sensitive Information. CVSS score: 7.4/10. Published 2023-03-13.
- How severe is CVE-2023-27587?
- High severity. CVSS v3 base score is 7.4 out of 10.
- Is CVE-2023-27587 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.