Vulnerability · Published Nov 11, 2024 · Assigned by GitHub_M

CVE-2024-51486Stored Cross-Site Scripting in Ampache

Medium 5.5

In plain English

A medium-severity cross-site scripting in ampache from ampache. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)0.5%top 55.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Ampache is a web based audio/video streaming application and file manager. The vulnerability exists in the interface section of the Ampache menu, where users can change the "Custom URL - Favicon". This section is not properly sanitized, allowing for the input of strings that can execute JavaScript. This issue has been addressed in version 7.0.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products (as reported)

Vendor	Product	Versions
ampache	ampache	< 7.0.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

References

https://github.com/ampache/ampache/security/advisories/GHSA-4xw5-f7xm-vpw5 x_refsource_CONFIRM