PT-2023-19095 · Jellyfin · Jellyfin

Christian Pöschl · Published 2023-02-03 · Updated 2025-03-26 · CVE-2023-23635

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jellyfin versions 10.8.x through 10.8.3

Description The issue concerns stored XSS in the name of a collection. This allows an attacker to steal access tokens from the localStorage of the victim.

Recommendations For Jellyfin versions 10.8.x through 10.8.3, consider restricting the ability to edit collection names to prevent potential exploitation until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-23635

GHSA-749C-PC87-4QCW

Affected Products

Jellyfin

References · 11

• 🔥 https://herolab.usd.de/security-advisories/usd-2022-0031 · Exploit
• https://osv.dev/vulnerability/GHSA-749c-pc87-4qcw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23635 · Security Note
• https://osv.dev/vulnerability/CVE-2023-23635 · Vendor Advisory
• https://github.com/jellyfin/jellyfin/releases/tag/v10.8.4 · Note
• https://github.com/jellyfin/jellyfin-web/issues/3788 · Note
• https://github.com/jellyfin/jellyfin-web/pull/3789 · Note
• https://github.com/jellyfin/jellyfin-web · Note
• https://t.me/cvenotify/116406 · Telegram Post
• https://herolab.usd.de/security-advisories · Note
• https://t.me/cibsecurity/57433 · Telegram Post