Vulnerability · Published Sep 9, 2021 · Assigned by GitHub_M

CVE-2021-32833Unauthenticated file read in Emby Server

High 8.6

In plain English

A high-severity security flaw in Emby.Releases from MediaBrowser. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)1.3%top 30.0% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Emby Server is a personal media server with apps on many devices. In Emby Server on Windows there is a set of arbitrary file read vulnerabilities. This vulnerability is known to exist in version 4.6.4.0 and may not be patched in later versions. Known vulnerable routes are /Videos/Id/hls/PlaylistId/SegmentId.SegmentContainer, /Images/Ratings/theme/name and /Images/MediaInfo/theme/name. For more details including proof of concept code, refer to the referenced GHSL-2021-051. This issue may lead to unauthorized access to the system especially when Emby Server is configured to be accessible from the Internet.

Affected products (as reported)

Vendor	Product	Versions
MediaBrowser	Emby.Releases	<= 4.6.4.0

Weakness: CWE-552 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

https://securitylab.github.com/advisories/GHSL-2021-051-emby/ x_refsource_CONFIRM