morpheus65535/bazarr

GitHub

github.com

www.bazarr.media

Releases995

Frequency2 days 20 hours

Last Release 2 days ago

Stars4.04K

Bazarr is a companion application to Sonarr and Radarr. It manages and downloads subtitles based on your requirements. You define your preferences by TV show or movie and Bazarr takes care of everything for you.

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2023-50266 ↗	Dec 15, 2023Friday, 15 December 2023, 21:15	5.3 MEDIUM	—
Bazarr manages and downloads subtitles. In version 1.2.4, the proxy method in bazarr/bazarr/app/ui.py does not validate the user-controlled protocol and url variables and passes them to requests.get() without any sanitization, which leads to a blind server-side request forgery (SSRF). This issue allows for crafting GET requests to internal and external resources on behalf of the server. 1.3.1 contains a partial fix, which limits the vulnerability to HTTP/HTTPS protocols.
CVE-2023-50264 ↗	Dec 15, 2023Friday, 15 December 2023, 21:15	7.5 HIGH	—
Bazarr manages and downloads subtitles. Prior to 1.3.1, Bazarr contains an arbitrary file read in /system/backup/download/ endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the send_file function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1.
CVE-2023-50265 ↗	Dec 15, 2023Friday, 15 December 2023, 21:15	7.5 HIGH	—
Bazarr manages and downloads subtitles. Prior to 1.3.1, the /api/swaggerui/static endpoint in bazarr/app/ui.py does not validate the user-controlled filename variable and uses it in the send_file function, which leads to an arbitrary file read on the system. This issue is fixed in version 1.3.1.