CVE-2017-16896 A SQL injection in classes/handler/public.php in the forgotpass component of Tiny Tiny RSS 17.4 exists via the login parameter.
CriticalCVSS 9.8
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A SQL injection in classes/handler/public.php in the forgotpass component of Tiny Tiny RSS 17.4 exists via the login parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ubuntu/tt-rss(Ubuntu:22.04) | All versions | No fix listed |
| debian/tt-rss(Debian:12) | < 17.4+git20180312+dfsg-1 | 17.4+git20180312+dfsg-1 |
| tt-rss tiny tiny rss | = 17.4 | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2017-16896 vendor-advisory
- discourse.tt-rss.org patch vendor-advisory
- git.tt-rss.org patch
- bugs.debian.org issue-tracking