← Back

CVE-2024-51486

nvd nist
Published: Nov 11, 2024Modified: Nov 21, 2024

JSON object

Loading...
8.4
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Exploitability: 1.7 / Impact: 6.0
Source: NVD

Description

Ampache is a web based audio/video streaming application and file manager. The vulnerability exists in the interface section of the Ampache menu, where users can change the "Custom URL - Favicon". This section is not properly sanitized, allowing for the input of strings that can execute JavaScript. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected (1)

Products: Ampache: Ampache
Ampache
1 product
Ampache
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Ampache
Version 7.0.0

Related CWEs

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (1)

Source: security-advisories@github.com
ExploitThird Party Advisory

Timeline

No history available yet.