CVE-2021-28373 - CVE House
Back to Database
Status published High CVE-2021-28373

The auth_internal plugin in Tiny Tiny RSS (aka tt-rss) before...

Vulnerability Description

The auth_internal plugin in Tiny Tiny RSS (aka tt-rss) before 2021-03-12 allows an attacker to log in via the OTP code without a valid password. NOTE: this issue only affected the git master branch for a short time. However, all end users are explicitly directed to use the git master branch in production. Semantic version numbers such as 21.03 appear to exist, but are automatically generated from the year and month. They are not releases.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-28373

Credits & Attribution

No credits recorded in the NVD database.

References

More from tt-rss

View All →
CVE-2020-25789
An issue was discovered in Tiny Tiny RSS (aka tt-rss)...
Medium 6.1
CVE-2020-25788
An issue was discovered in Tiny Tiny RSS (aka tt-rss)...
High 8.1
CVE-2020-25787
An issue was discovered in Tiny Tiny RSS (aka tt-rss)...
Critical 9.8
CVE-2017-16896
A SQL injection in classes/handler/public.php in the forgotpass component of...
Critical 9.8
CVE-2017-1000035
Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener...
Medium 6.1

Affected Vendor

Affected Software

tiny tiny rss
Vulnerable Versions:
0

Timeline

Official Publish: March 13th, 2021
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.