CVE-2022-23497

FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configurations contain hashed passwords (brypt with cost 9, salted) of FreshRSS Web interface. If the API is used, the configuration might contain a hashed password (brypt with cost 9, salted) of the GReader API, and a hashed password (MD5 salted) of the Fever API. Users should update to version 1.20.2 or edge. Users unable to upgrade can apply the patch manually or delete the file `./FreshRSS/p/ext.php`.

• CWE-200

• https://github.com/FreshRSS/FreshRSS/pull/4928Patch, Third Party Advisory
• https://github.com/FreshRSS/FreshRSS/releases/tag/1.20.2Patch, Third Party Advisory
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-hvrj-5fwj-p7v6Third Party Advisory
• https://github.com/FreshRSS/FreshRSS/pull/4928Patch, Third Party Advisory
• https://github.com/FreshRSS/FreshRSS/releases/tag/1.20.2Patch, Third Party Advisory
• https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-hvrj-5fwj-p7v6Third Party Advisory

Published

Dec 9, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23491Certifi is a curated collection of Root Certificates for val…7.5
• CVE-2022-23492go-libp2p is the offical libp2p implementation in the Go pro…7.5
• CVE-2022-23493xrdp is an open source project which provides a graphical lo…9.1
• CVE-2022-23494tinymce is an open source rich text editor. A cross-site scr…6.1
• CVE-2022-23495go-merkledag implements the 'DAGService' interface and adds …7.5
• CVE-2022-23496 Yet Another UserAgent Analyzer (Yauaa) is a java library th…7.5
• CVE-2022-23498Grafana is an open-source platform for monitoring and observ…8.8
• CVE-2022-23499HTML sanitizer is written in PHP, aiming to provide XSS-safe…6.1
• CVE-2022-2350The Disable User Login WordPress plugin through 1.0.1 does n…5.3
• CVE-2022-23500TYPO3 is an open source PHP based web content management sys…7.5
• CVE-2022-23501TYPO3 is an open source PHP based web content management sys…6.5
• CVE-2022-23502TYPO3 is an open source PHP based web content management sys…5.4