CVE-2023-50258

Katalog CVE

CVSS 5.3 · Medium EPSS 0,69%

Kerentanan Server-Side Request Forgery (SSRF) pada pymedusa medusa. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery (SSRF). The `testDiscord` request handler in `medusa/server/web/home/handler.py` does not validate the user-controlled `discord_webhook` variable and passes it to the `notifiers.discord_notifier.test_notify` method, then `_notify_discord` and finally `_send_discord_msg` method, which sends a POST request to the user-controlled URL on line 64 in `/medusa/notifiers/discord.py`, which leads to a blind server-side request forgery. This issue allows for crafting POST requests on behalf of the Medusa server. Version 1.0.19 contains a fix for the issue.

Rincian

Terbit di NVD

22 Desember 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,69% peluang dieksploitasi; lebih tinggi dari 51,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/pymedusa/Medusa/security/advisories/GHSA-3hph-6586-qv9g exploit · advisory vendor
• https://securitylab.github.com/advisories/GHSL-2023-201_GHSL-2023-202_Medusa/ exploit · advisory pihak ketiga
• https://github.com/pymedusa/Medusa/blob/3d656652ab277e47689483912ed7fc443e7023e8/medusa/notifiers/discord.py#L... product
• https://github.com/pymedusa/Medusa/blob/3d656652ab277e47689483912ed7fc443e7023e8/medusa/server/web/home/handle... product
• https://github.com/pymedusa/Medusa/releases/tag/v1.0.19 release notes