tiny tiny rss vulnerabilities and fixes

Recent CVEs affecting tiny tiny rss, with upgrade or downgrade steps. 6 tracked.

Also searched as: tinytinyrss.

tiny tiny rss has 6 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 4. Most recent: 2021-03-13. Highest priority: CVE-2020-25787 (score 69/100).

• CVE-2021-28373 HIGH 7.5 UPGRADE The auth_internal plugin in Tiny Tiny RSS (aka tt-rss) before 2021-03-12 allows an attacker to log in via the
• CVE-2020-25789 MEDIUM 6.1 UPGRADE An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16
• CVE-2020-25788 HIGH 8.1 UPGRADE An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16
• CVE-2020-25787 CRITICAL 9.8 UPGRADE An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16
• CVE-2017-16896 CRITICAL 9.8 DOWNGRADE A SQL injection in classes/handler/public.php in the forgotpass component of Tiny Tiny RSS 17.4 exists via the
• CVE-2017-1000035 MEDIUM 6.1 MITIGATE Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack

FAQ

How do I fix tiny tiny rss vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is tiny tiny rss being exploited right now?

None of the tracked tiny tiny rss CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which tiny tiny rss CVE should I patch first?

CVE-2020-25787 currently ranks highest (69/100): An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16.

RSS feed for tiny tiny rss · ← Back to latest CVEs