PT-2019-20125 · Plex · Tautulli

Published 2019-02-19 · Updated 2019-02-19

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tautulli version 2.1.26

Description The issue concerns a problem with handling a crafted Plex username, which leads to XSS when constructing the History page, specifically affecting the data/interfaces/default/history.html file.

Recommendations For Tautulli version 2.1.26, consider restricting the use of the History page until a patch is available, and avoid using crafted Plex usernames to minimize the risk of exploitation.

Fix

Related Identifiers

PYSEC-2019-255

Affected Products

Tautulli

References · 3

• https://osv.dev/vulnerability/PYSEC-2019-255 · Vendor Advisory
• https://github.com/Tautulli/Tautulli-Issues/issues/161 · Note
• http://securityfocus.com/bid/107171 · Note