icon

We found results for “

CVE-2023-50259

Date: December 22, 2023

Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery (SSRF). The "testslack" request handler in "medusa/server/web/home/handler.py" does not validate the user-controlled "slack_webhook" variable and passes it to the "notifiers.slack_notifier.test_notify" method, then "_notify_slack" and finally "_send_slack" method, which sends a POST request to the user-controlled URL on line 103 in "/medusa/notifiers/slack.py", which leads to a blind server-side request forgery (SSRF). This issue allows for crafting POST requests on behalf of the Medusa server. Version 1.0.19 contains a fix for the issue.

Language: Python

Severity Score

Severity Score

Weakness Type (CWE)

Server-Side Request Forgery (SSRF)

CWE-918

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): LOW
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us