PT-2019-20124 · Tautulli · Tautulli

Published 2019-12-18 · Updated 2019-12-18

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Tautulli version 2.1.9

Description The issue allows an attacker to shut down a remote media server due to a CSRF vulnerability in the "/shutdown" API endpoint. Additionally, anonymous access can be achieved in certain applications lacking a user login area.

Recommendations For Tautulli version 2.1.9, consider disabling access to the "/shutdown" API endpoint until a patch is available to prevent unauthorized shutdown of the media server. Restrict access to the Tautulli application to minimize the risk of exploitation, especially in applications without a user login area.

Fix

Related Identifiers

PYSEC-2019-254

Affected Products

Tautulli

References · 4

• https://osv.dev/vulnerability/PYSEC-2019-254 · Vendor Advisory
• https://github.com/Tautulli/Tautulli/compare/v2.1.9...v2.1.10-beta · Note
• http://packetstormsecurity.com/files/155710/Tautulli-2.1.9-Cross-Site-Request-Forgery.html · Note
• http://packetstormsecurity.com/files/155974/Tautulli-2.1.9-Denial-Of-Service.html · Note