tt-rss vulnerabilities

Recent CVEs affecting tt-rss products. 6 tracked.

tt-rss has 6 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 4. Most recent: 2021-03-13. Highest priority: CVE-2020-25787 (score 69/100).

• CVE-2021-28373 HIGH 7.5 UPGRADE The auth_internal plugin in Tiny Tiny RSS (aka tt-rss) before 2021-03-12 allows an attacker to log in via the
• CVE-2020-25789 MEDIUM 6.1 UPGRADE An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16
• CVE-2020-25788 HIGH 8.1 UPGRADE An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16
• CVE-2020-25787 CRITICAL 9.8 UPGRADE An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16
• CVE-2017-16896 CRITICAL 9.8 DOWNGRADE A SQL injection in classes/handler/public.php in the forgotpass component of Tiny Tiny RSS 17.4 exists via the
• CVE-2017-1000035 MEDIUM 6.1 MITIGATE Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack

FAQ

How do I fix tt-rss vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is tt-rss being exploited right now?

None of the tracked tt-rss CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which tt-rss CVE should I patch first?

CVE-2020-25787 currently ranks highest (69/100): An issue was discovered in Tiny Tiny RSS (aka tt-rss) before 2020-09-16.

Products

• tiny tiny rss

RSS feed for tt-rss · ← Back to latest CVEs