CVE-2021-32644

Published: Jun 22, 2021Modified: Nov 21, 2024

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

Ampache is an open source web based audio/video streaming application and file manager. Due to a lack of input filtering versions 4.x.y are vulnerable to code injection in random.php. The attack requires user authentication to access the random.php page unless the site is running in demo mode. This issue has been resolved in 4.4.3.

Affected (1)

Products: Ampache: Ampache

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ampache Ampache	Version 4.4.2

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://github.com/ampache/ampache/commit/c9453841e1b517a1660c3da1efd1fe5d623c93a5

Source: security-advisories@github.com

PatchThird Party Advisory

https://github.com/ampache/ampache/security/advisories/GHSA-vqpj-xgw2-r54q

Source: security-advisories@github.com

Third Party Advisory

https://github.com/ampache/ampache/commit/c9453841e1b517a1660c3da1efd1fe5d623c93a5

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/ampache/ampache/security/advisories/GHSA-vqpj-xgw2-r54q

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.