PT-2019-15975 · Tautulli · Tautulli

Published 2019-12-18 · Updated 2023-02-01 · CVE-2019-19833

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Tautulli version 2.1.9

Description The issue allows an attacker to shut down a remote media server due to a CSRF vulnerability in the "/shutdown" API endpoint. Additionally, anonymous access can be achieved in applications lacking a user login area.

Recommendations For Tautulli version 2.1.9, consider disabling access to the "/shutdown" API endpoint until a patch is available to prevent unauthorized shutdown of the media server. Restrict access to the application to minimize the risk of anonymous access in cases where a user login area is not present.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-19833

Affected Products

Tautulli

References · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/tautulli_shutdown_exec.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/155710/Tautulli-2.1.9-Cross-Site-Request-Forgery.html · Exploit
• 🔥 http://packetstormsecurity.com/files/155974/Tautulli-2.1.9-Denial-Of-Service.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-19833 · Security Note
• https://osv.dev/vulnerability/CVE-2019-19833 · Vendor Advisory
• https://github.com/Tautulli/Tautulli/compare/v2.1.9...v2.1.10-beta · Note