Freshrss CVE-2025-31134

CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates high confidentiality impact with low barriers to exploitation: network-accessible, no authentication required, no complexity, no user interaction. However, the impact is limited to information disclosure (C:H) with no integrity or availability impact (I:N/A:N), placing this in reconnaissance/pre-attack phases rather than direct compromise. The vulnerability is valuable as an initial reconnaissance vector but does not directly lead to system compromise without chaining with additional vulnerabilities. KEV/active exploitation status is not indicated in provided data, and no EPSS score is provided; without KEV confirmation or EPSS >0.97, this is a moderate real-world priority—critical for defense-in-depth but not a critical vulnerability on its own. Organizations running FreshRSS in exposed environments should prioritize patching to deny reconnaissance opportunities.

An attacker performs reconnaissance on a FreshRSS instance exposed at https://feeds.example.com. Without authentication, they systematically send HTTP requests to probe for directories: /old_php/, /php5.4/, /php7.0/, /admin/, /config/, /vendor/, etc. By analyzing HTTP response codes, error messages, or response times, they determine that PHP 7.2 is installed and Apache modules suggest a specific configuration. They then cross-reference this information with known CVEs affecting PHP 7.2 or that specific Apache setup, discovering CVE-2024-XXXXX affecting the target. The attacker then crafts a second-stage exploit targeting the identified vulnerability. This attack requires no authentication, no user interaction, and can be automated across thousands of targets. Tools like nmap, nikto, or custom scripts can enumerate target systems at scale.