Description

PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload form. Attackers can manipulate the 'shortdesc' parameter to trigger external HTTP requests to arbitrary endpoints during podcast episode creation.

Remediation

References

CVE-2023-53899

Related Vulnerabilities

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-4591)

PrestaShop Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2012-6641)

WordPress Plugin Facebook Like Box Multiple Vulnerabilities (2.9.1)

MediaWiki Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2022-29905)

WordPress Plugin Booking Calendar PHP Object Injection (9.1)

Severity

Critical

Classification

CVE-2023-53899 CWE-918 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities