CVE catalog

CVE-2017-16896

tt-rss: CVE-2017-16896

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.48% · Oct 25, 2026

A SQL injection in classes/handler/public.php in the forgotpass component of Tiny Tiny RSS 17.4 exists via the login parameter.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiantt-rsssid21~git20210204.b4cbc79+dfsg-2fixed
Debiantt-rssbookworm21~git20210204.b4cbc79+dfsg-1.2fixed
Ubuntutt-rss16.041.15+dfsg-1vulnerable
Ubuntutt-rss16.0415.7+git20151123+dfsg-1vulnerable
Ubuntutt-rss16.0415.7+git20151123+dfsg-1ubuntu1vulnerable
Ubuntutt-rss18.0417.1+git20170410+dfsg-2vulnerable
Ubuntutt-rss18.0417.1+git20170410+dfsg-2ubuntu1vulnerable
Ubuntutt-rss22.0421~git20210204.b4cbc79+dfsg-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiantt-rsssourcesid17.4+git20180312+dfsg-1not yet assignedNot reported[882543]
Debiantt-rsssourcebookworm17.4+git20180312+dfsg-1not yet assignedNot reported[882543]

[Debian bug #882543]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [tt-rss]Fixed
    Details (2)

    • 21~git20210204.b4cbc79+dfsg-1.2 · all · bookworm

      Fixed · Fixed: 17.4+git20180312+dfsg-1

      dsa · tt-rss · debian · bookworm; dsa · tt-rss · debian · 12

    • 21~git20210204.b4cbc79+dfsg-1.2 · all · bookworm

      Fixed · Fixed: 17.4+git20180312+dfsg-1

      dsa · tt-rss · debian · bookworm; dsa · tt-rss · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]