Login Request a demo
Medium severity · published Jul 10, 2023
CVE-2023-3566
A vulnerability was found in wallabag 2.5.4
6.5
CVSS
1.4%
EPSS
No
On KEV
Description
A vulnerability was found in wallabag 2.5.4. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /config of the component Profile Config. The manipulation of the argument Name leads to allocation of resources. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-233359. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
Wallabag · Wallabag
2.5.4 · source: NVD
Affected product
WA
Wallabag
Wallabag
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-3566
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-3566
Exploit
https://github.com/ctflearner/Vulnerability/blob/main/WALLABAG/NAME-LIMIT.md
Permissions Required
https://vuldb.com/?ctiid.233359
Permissions Required
https://vuldb.com/?id.233359
Exploit
https://youtu.be/ouwud0PlHkE
More from Wallabag
6.5
CVE-2023-0737
wallabag version 2.5.2 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to arbitrarily delete user accounts via the /account/delete endpoint
6.5
CVE-2023-4455
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3
6.5
CVE-2023-0735
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.5.4
6.4
CVE-2026-82081
wallabag 2 through 2.6.14 allows SSRF because a crafted title or content field is mishandled during PDF export
5.7
CVE-2023-4454
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3