CVE-2023-22481: Sensitive information exposure in the logs of greader API in FreshRSS

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-03-06 · updated 2026-06-17
Weakness: CWE-532

Description

FreshRSS is a self-hosted RSS feed aggregator. When using the greader API, the provided password is logged in clear in `users/_/log_api.txt` in the case where the authentication fails. The issues occurs in `authorizationToUser()` in `greader.php`. If there is an issue with the request or the credentials, `unauthorized()` or `badRequest()` is called. Both these functions are printing the return of `debugInfo()` in the logs. `debugInfo()` will return the content of the request. By default, this will be saved in `users/_/log_api.txt` and if the const `COPY_LOG_TO_SYSLOG` is true, in syslogs as well. Exploiting this issue requires having access to logs produced by FreshRSS. Using the information from the logs, a malicious individual could get users' API keys (would be displayed if the users fills in a bad username) or passwords.

Affected products

FreshRSS: from 1.9.0 before 1.21.0 — fixed in 1.21.0

How to fix

Upgrade to a fixed version: FreshRSS 1.21.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-22481 or the next vulnerability affects your stack