PT-2023-24210 · Emby · Emby Server

Finder + 2 · Published 2023-05-30 · Updated 2025-12-27 · CVE-2023-33193

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Emby Server versions prior to 4.7.12 Emby Server Beta versions prior to 4.8.31

Description This issue may allow administrative access to an Emby Server system, depending on certain user account settings. By spoofing certain headers intended for interoperation with reverse proxy servers, it may be possible to affect the local/non-local network determination, allowing logging in without a password or viewing a list of user accounts that may have no password configured. Impacted are all Emby Server systems that are publicly accessible and where the administrator hasn't tightened the account login configuration for administrative users.

Recommendations For Emby Server versions prior to 4.7.12, update to version 4.7.12 or later to resolve the issue. For Emby Server Beta versions prior to 4.8.31, update to version 4.8.31 or later to resolve the issue. As a temporary workaround, consider tightening the account login configuration for administrative users to minimize the risk of exploitation. Restrict access to the Emby Server system to only necessary users and networks.

Exploit

Fix

HTTP Request/Response Smuggling

Weakness Enumeration

CWE-444

Related Identifiers

CVE-2023-33193

GHSA-FFFJ-6FR6-3FGF

Affected Products

Emby Server

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33193.json · Exploit
• https://github.com/EmbySupport/security/security/advisories/GHSA-fffj-6fr6-3fgf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33193 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33193 · Vendor Advisory
• https://t.me/cvenotify/51773 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/2004915201859334594 · Twitter Post
• https://t.me/cvenotify/51346 · Telegram Post