Read the docs
TI-2023-27487 Aliases CVE-2023-50259

Blind SSRF in /home/testslack endpoint

Priority MEDIUM 63CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery (SSRF). The `testslack` request handler in `medusa/server/web/home/handler.py` does not validate the user-controlled `slack_webhook` variable and passes it to the `notifiers.slack_notifier.test_notify` method, then `_notify_slack` and finally `_send_slack` method, which sends a POST request to the user-controlled URL on line 103 in `/medusa/notifiers/slack.py`, which leads to a blind server-side request forgery (SSRF). This issue allows for crafting POST requests on behalf of the Medusa server. Version 1.0.19 contains a fix for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00602 49th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Medusa (pymedusa): 1.0.19

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
pymedusaMedusabefore 1.0.191.0.19Patch availableCNA
  • Medusa Vendorpymedusa Affected before 1.0.19 Fixed in 1.0.19 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pymedusa:medusa:*:*:*:*:*:*:*:*before 1.0.19Vulnerablepymedusa
  • cpe:2.3:a:pymedusa:medusa:*:*:*:*:*:*:*:* Versions before 1.0.19 Vulnerable ·pymedusa

Remediation

  • Fix · CNA Medusa (pymedusa) Fixed in 1.0.19

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-50259

References

Exploit 2

Patch 2

Other 1

  • TI-2023-13146 OS Command Injection via GIT_PATH in pymedusa CVSS 3.1HIGH 8.8
  • TI-2023-27486 Blind SSRF in `/home/testdiscord` endpoint CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences