PT-2019-8310 · Ampache · Ampache

Fenceposterror · Published 2019-05-24 · Updated 2019-05-30 · CVE-2017-18375

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ampache version 3.8.3

Description The issue allows PHP Object Instantiation via "democratic.ajax.php" and "democratic.class.php".

Recommendations For Ampache version 3.8.3, consider restricting access to the "democratic.ajax.php" and "democratic.class.php" files until a patch is available.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2017-18375

Affected Products

Ampache

References · 7

• 🔥 https://fenceposterror.github.io/2017/06/16/Hacking-For-Fun-And-Non-Profit.html · Exploit
• https://ubuntu.com/security/CVE-2017-18375 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-18375 · Security Note
• https://osv.dev/vulnerability/CVE-2017-18375 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-18375 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18375 · Security Note
• https://github.com/ampache/ampache/issues/1555 · Note