Filtered by vendor Posthog Subscriptions
Filtered by product Posthog Subscriptions
Total 3 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-9710 1 Posthog 1 Posthog 2025-01-04 8.3 High
PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PostHog. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the database_schema method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-25351.
CVE-2023-46746 1 Posthog 1 Posthog 2024-11-21 4.8 Medium
PostHog provides open-source product analytics, session recording, feature flagging and A/B testing that you can self-host. A server-side request forgery (SSRF), which can only be exploited by authenticated users, was found in Posthog. Posthog did not verify whether a URL was local when enabling webhooks, allowing authenticated users to forge a POST request. This vulnerability has been addressed in `22bd5942` and will be included in subsequent releases. There are no known workarounds for this vulnerability.
CVE-2022-0645 1 Posthog 1 Posthog 2024-11-21 6.1 Medium
Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in GitHub repository posthog/posthog prior to 1.34.1.