CVE-2023-41055
CVSS 3.1 Score 7.5 of 10 (high)
Details
Summary
CVE-2023-41055 is a Server-Side Request Forgery (SSRF) vulnerability affecting LibreY, a privacy-respecting meta search engine. The flaw resides in the `engines/google/text.php` and `engines/duckduckgo/text.php` files and impacts versions prior to commit be59098abd119cda70b15bf3faac596dfd39a744. This flaw enables remote attackers to issue HTTP GET requests to arbitrary targets, potentially leading to Denial-of-Service (DoS) attacks. Attackers can request the server to download large files or even deny access to legitimate users, reducing the server's performance. The issue has been addressed in the latest commit available at https://github.com/Ahwxorg/LibreY/pull/9. LibreY hosts are urged to upgrade to the latest version, and no known workarounds for this vulnerability have been identified.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions