PT-2021-18251 · Jellyfin · Jellyfin

Hydragyrum + 2 · Published 2021-05-05 · Updated 2021-05-13 · CVE-2021-29490

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Jellyfin versions prior to 10.7.3

Description: The issue allows unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter, potentially exposing internal and external HTTP servers or other resources available via HTTP GET that are visible from the Jellyfin server.

Recommendations: For versions prior to 10.7.3, update to version 10.7.3 to resolve the issue. As a temporary workaround, consider disabling external access to the API endpoints "/Items/*/RemoteImages/Download", "/Items/RemoteSearch/Image", and "/Images/Remote" via reverse proxy, or limit access to known-friendly IPs.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2021-29490

GHSA-RGJW-4FWC-9V96

Affected Products

Jellyfin

References · 3

• https://github.com/jellyfin/jellyfin/security/advisories/GHSA-rgjw-4fwc-9v96 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-29490 · Security Note
• https://osv.dev/vulnerability/CVE-2021-29490 · Vendor Advisory