TI-2022-07696 Aliases CVE-2022-23644

Server-side request forgery in BookWyrm

MEDIUM 42CWE-918Published 2022-02-16 · Updated 2025-04-23

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server-side request forgery attack. Any BookWyrm instance running a version prior to v0.3.0 is susceptible to attack from a logged-in user. The problem has been patched and administrators should upgrade to version 0.3.0 As a workaround, BookWyrm instances can close registration and limit members to trusted individuals.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00905 60th percentileScored 2026-11-07

Fix Fixed bookwyrm (bookwyrm-social): 0.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
bookwyrm-social	bookwyrm	before 0.3.0	0.3.0	Patch available	CNA

bookwyrm Vendorbookwyrm-social Affected before 0.3.0 Fixed in 0.3.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:joinbookwyrm:bookwyrm::::::::	before 0.3.0	Vulnerable	bookwyrm-social

cpe:2.3:a:joinbookwyrm:bookwyrm:*:*:*:*:*:*:*:* Versions before 0.3.0 Vulnerable ·bookwyrm-social

Remediation

Fix · CNA bookwyrm (bookwyrm-social) Fixed in 0.3.0

Timeline

2026-10-02 Threatist record created from CVE-2022-23644

References

Advisory 1

https://github.com/bookwyrm-social/bookwyrm/security/advisories/GHSA-5m7g-66h6-5cvq

TI-2022-16352 Missing rate limit in Authentication in bookwyrm CVSS 3.1CRITICAL 9.8
TI-2022-16380 URL Redirection to Untrusted Site ('Open Redirect') in bookwyrm CVSS 3.1HIGH 7.1
TI-2022-02451 Authentication Bypass by Primary Weakness in bookwyrm-social/bookwyrm CVSS 3.1CRITICAL 9.8
TI-2022-13180 Cross-site Scripting in BookWyrm CVSS 3.1MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences