PT-2021-3394 · Ampache · Ampache

Ali Oguz · Published 2021-06-22 · Updated 2021-08-15 · CVE-2021-32644

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ampache versions 4.x.y through 4.4.2

Description The issue is related to a lack of protection for the web page structure, which can be exploited for cross-site scripting attacks. Additionally, there is a code injection vulnerability in the random.php file due to insufficient input filtering. The exploitation of this issue may require user authentication to access the vulnerable page, unless the site is in demo mode.

Recommendations For Ampache versions 4.x.y through 4.4.2, update to version 4.4.3 to resolve the issue. As a temporary workaround, consider restricting access to the random.php page to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-03245

CVE-2021-32644

GHSA-VQPJ-XGW2-R54Q

Affected Products

Ampache

References · 10

• 🔥 https://github.com/dnr6419/CVE-2021-32644 · Exploit
• https://github.com/ampache/ampache/commit/c9453841e1b517a1660c3da1efd1fe5d623c93a5 · Patch
• https://bdu.fstec.ru/vul/2021-03245 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32644 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32644 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32644 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32644 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-32644 · Security Note
• https://github.com/ampache/ampache/security/advisories/GHSA-vqpj-xgw2-r54q · Note
• https://t.me/cybersecuritytechnologies/4072 · Telegram Post