CVE-2021-28373: tt-rss tiny tiny rss

csirt@kutim:~/threat-intel/cve/CVE-2021-28373

CVSS 7.5 · High EPSS 0,93%

Kerentanan Incorrect Authorization pada tt-rss tiny tiny rss. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The auth_internal plugin in Tiny Tiny RSS (aka tt-rss) before 2021-03-12 allows an attacker to log in via the OTP code without a valid password. NOTE: this issue only affected the git master branch for a short time. However, all end users are explicitly directed to use the git master branch in production. Semantic version numbers such as 21.03 appear to exist, but are automatically generated from the year and month. They are not releases.

Rincian

Terbit di NVD: 13 Maret 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-863: Incorrect Authorization
EPSS (30 hari): 0,93% peluang dieksploitasi; lebih tinggi dari 59,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
tt-rss	tiny tiny rss	Semua versi sebelum 2021-03-12

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://community.tt-rss.org/t/check-password-not-called-if-otp-is-enabled-update-asap-if-youre-using-2fa/4502 issue tracking · patch · advisory vendor
https://git.tt-rss.org/fox/tt-rss/commit/4949e1a59059d9e72ba7a98f783cec312c06c6d2 patch · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.