CVE-2023-27592 is a medium-severity cross-site scripting (XSS) vulnerability affecting Miniflux versions prior to 2.0.43. It arises from improper handling of failed image proxy requests, allowing an attacker to inject unescaped JavaScript into a user's browser. An attacker can achieve this by crafting an RSS feed with a malicious image URL, leading to arbitrary JavaScript execution in the victim's Miniflux session. While not actively exploited and lacking public exploit code, the vulnerability could allow an attacker to perform actions as the victim user, potentially escalating to administrative access.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.0.25, < 2.0.43CPE matchmatch criteria | cpe:2.3:a:miniflux_project:miniflux:*:*:*:*:*:go:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.