PT-2025-9852 · Ampache · Ampache

Nitipoom Jaroonchaipipat · Publicado 2025-03-05 · Atualizado 2025-03-07 · CVE-2024-51144

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ampache versions 6.6.0 and earlier

Description A Cross Site Request Forgery (CSRF) issue exists in the "pvmsg.php?action=add message", "pvmsg.php?action=confirm delete", and "ajax.server.php?page=user&action=flip follow" endpoints.

Recommendations For Ampache versions 6.6.0 and earlier, update to a version later than 6.6.0 to resolve the issue. As a temporary workaround, consider restricting access to the "pvmsg.php?action=add message", "pvmsg.php?action=confirm delete", and "ajax.server.php?page=user&action=flip follow" endpoints until a patch is available.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2024-51144

Produtos afetados

Ampache

Referências · 12

• https://github.com/ampache/ampache · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-51144 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2024-51144 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1897506960523608261 · Publicação no Twitter
• https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2024-51144 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2024-51144 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2024-51144 · Aviso do Fabricante
• https://t.me/cvedetector/19653 · Publicação no Telegram
• https://cve.org/CVERecord?id=CVE-2024-51144 · Nota de Segurança
• https://twitter.com/cybercronai/status/1897823422186459453 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1897454310931288106 · Publicação no Twitter
• https://nitipoom-jar.github.io/CVE-2024-51144 · Nota