PT-2023-19095 · Jellyfin · Jellyfin

Christian Pöschl · Publicado 2023-02-03 · Atualizado 2025-03-26 · CVE-2023-23635

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jellyfin versions 10.8.x through 10.8.3

Description The issue concerns stored XSS in the name of a collection. This allows an attacker to steal access tokens from the localStorage of the victim.

Recommendations For Jellyfin versions 10.8.x through 10.8.3, consider restricting the ability to edit collection names to prevent potential exploitation until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-23635

GHSA-749C-PC87-4QCW

Produtos afetados

Jellyfin

Referências · 11

• 🔥 https://herolab.usd.de/security-advisories/usd-2022-0031 · Exploit
• https://github.com/jellyfin/jellyfin/releases/tag/v10.8.4 · Nota
• https://github.com/jellyfin/jellyfin-web/issues/3788 · Nota
• https://github.com/jellyfin/jellyfin-web/pull/3789 · Nota
• https://github.com/jellyfin/jellyfin-web · Nota
• https://osv.dev/vulnerability/GHSA-749c-pc87-4qcw · Aviso do Fabricante
• https://t.me/cvenotify/116406 · Publicação no Telegram
• https://herolab.usd.de/security-advisories · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-23635 · Nota de Segurança
• https://t.me/cibsecurity/57433 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-23635 · Aviso do Fabricante