PT-2021-14476 · Ampache · Ampache

Lachlan-00 · Published 2021-04-13 · Updated 2022-10-21 · CVE-2021-21399

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Ampache versions prior to 4.4.1

Description The issue allows unauthenticated access to Ampache using the subsonic API. To exploit this, an attacker must use a username that is not part of the site to bypass the auth checks.

Recommendations For versions prior to 4.4.1, update to version 4.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the subsonic API until a patch is applied. Avoid using unknown or unverified username values in the subsonic API to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Improper Access Control

Weakness Enumeration

CWE-287

CWE-284

Related Identifiers

CVE-2021-21399

GHSA-P9PM-J95J-5MJF

Affected Products

Ampache

References · 6

• 🔥 https://github.com/ampache/ampache/security/advisories/GHSA-p9pm-j95j-5mjf · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21399 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21399 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21399 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21399 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21399 · Security Note