PT-2019-20124 · Tautulli · Tautulli

Publicado 2019-12-18 · Atualizado 2019-12-18

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Tautulli version 2.1.9

Description The issue allows an attacker to shut down a remote media server due to a CSRF vulnerability in the "/shutdown" API endpoint. Additionally, anonymous access can be achieved in certain applications lacking a user login area.

Recommendations For Tautulli version 2.1.9, consider disabling access to the "/shutdown" API endpoint until a patch is available to prevent unauthorized shutdown of the media server. Restrict access to the Tautulli application to minimize the risk of exploitation, especially in applications without a user login area.

Correção

Identificadores relacionados

PYSEC-2019-254

Produtos afetados

Tautulli

Referências · 4

• https://github.com/Tautulli/Tautulli/compare/v2.1.9...v2.1.10-beta · Nota
• http://packetstormsecurity.com/files/155710/Tautulli-2.1.9-Cross-Site-Request-Forgery.html · Nota
• https://osv.dev/vulnerability/PYSEC-2019-254 · Aviso do Fabricante
• http://packetstormsecurity.com/files/155974/Tautulli-2.1.9-Denial-Of-Service.html · Nota