PT-2023-19096 · Jellyfin · Jellyfin

Christian Pöschl · Published 2023-02-03 · Updated 2025-03-26 · CVE-2023-23636

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Jellyfin versions 10.8.x through 10.8.3

Description The name of a playlist in Jellyfin is vulnerable to stored XSS, allowing an attacker to steal access tokens from the localStorage of the victim.

Recommendations For Jellyfin versions 10.8.x through 10.8.3, consider restricting the ability to create or edit playlist names until a patch is available to prevent stored XSS attacks. As a temporary workaround, users should be cautious when accessing playlists from untrusted sources. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-23636

GHSA-2H5R-CQFC-45V6

Affected Products

Jellyfin

References · 12

• 🔥 https://github.com/jellyfin/jellyfin-web/issues/3788 · Exploit
• 🔥 https://herolab.usd.de/security-advisories/usd-2022-0030 · Exploit
• https://osv.dev/vulnerability/CVE-2023-23636 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2h5r-cqfc-45v6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23636 · Security Note
• https://github.com/jellyfin/jellyfin/releases/tag/v10.8.4 · Note
• https://github.com/jellyfin/jellyfin-web/pull/3789 · Note
• https://github.com/jellyfin/jellyfin-web · Note
• https://t.me/cvenotify/116407 · Telegram Post
• https://t.me/cibsecurity/57442 · Telegram Post
• https://t.me/cvenotify/44023 · Telegram Post
• https://herolab.usd.de/security-advisories · Note