Skip to content

Blind SSRF in `Auth.js` (`GHSL-2023-266`)

Moderate
advplyr published GHSA-gjgj-98v3-47pg Dec 23, 2023

Package

audiobookshelf

Affected versions

2.6.0

Patched versions

2.7.0

Description

Summary

Audiobookshelf v2.6.0 is vulnerable to unauthenticated blind server-side request (SSRF) vulnerability in Auth.js.

Severity

Moderate

CVE ID

CVE-2023-51665

Weaknesses

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Learn more on MITRE.

Credits