PT-2023-19096 · Jellyfin · Jellyfin

Christian Pöschl · Publicado 2023-02-03 · Atualizado 2025-03-26 · CVE-2023-23636

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jellyfin versions 10.8.x through 10.8.3

Description The name of a playlist in Jellyfin is vulnerable to stored XSS, allowing an attacker to steal access tokens from the localStorage of the victim.

Recommendations For Jellyfin versions 10.8.x through 10.8.3, consider restricting the ability to create or edit playlist names until a patch is available to prevent stored XSS attacks. As a temporary workaround, users should be cautious when accessing playlists from untrusted sources. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-23636

GHSA-2H5R-CQFC-45V6

Produtos afetados

Jellyfin

Referências · 12

• 🔥 https://github.com/jellyfin/jellyfin-web/issues/3788 · Exploit
• 🔥 https://herolab.usd.de/security-advisories/usd-2022-0030 · Exploit
• https://github.com/jellyfin/jellyfin/releases/tag/v10.8.4 · Nota
• https://github.com/jellyfin/jellyfin-web/pull/3789 · Nota
• https://github.com/jellyfin/jellyfin-web · Nota
• https://t.me/cvenotify/116407 · Publicação no Telegram
• https://t.me/cibsecurity/57442 · Publicação no Telegram
• https://t.me/cvenotify/44023 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-23636 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-2h5r-cqfc-45v6 · Aviso do Fabricante
• https://herolab.usd.de/security-advisories · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-23636 · Nota de Segurança