CVE-2023-46746 is a Server-Side Request Forgery (SSRF) vulnerability affecting PostHog, an open-source product analytics platform. Authenticated users can exploit this flaw by manipulating webhook URLs, allowing them to forge POST requests to internal or external systems. Rated as MEDIUM severity (CVSS 4.3), the vulnerability has a low attack complexity and requires authentication, with a potential impact of low integrity. There is no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed in CISA's KEV catalog.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 1.43.1CPE matchmatch criteria | cpe:2.3:a:posthog:posthog:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.