CVE-2022-23644

HIGH

BookWyrm < 0.3.0 - Authenticated Server-Side Request Forgery via Cover URL Load

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-23644. PoCs published by tomorroisnew.

Description

BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server-side request forgery attack. Any BookWyrm instance running a version prior to v0.3.0 is susceptible to attack from a logged-in user. The problem has been patched and administrators should upgrade to version 0.3.0 As a workaround, BookWyrm instances can close registration and limit members to trusted individuals.

Exploits (1)

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.0089
EPSS Percentile 54.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-918
Status published
Products (1)
joinbookwyrm/bookwyrm < 0.3.0
Published Feb 16, 2022
Tracked Since Feb 18, 2026