PT-2023-30911 · Jellyfin · Jellyfin

Kwstubbs

·

Published

2023-12-13

·

Updated

2023-12-18

·

CVE-2023-48702

CVSS v3.1

7.2

High

VectorAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Jellyfin versions prior to 10.8.13
Description Jellyfin is a system for managing and streaming media. The /System/MediaEncoder/Path endpoint executes an arbitrary file using ProcessStartInfo via the ValidateVersion function. A malicious administrator can setup a network share and supply a UNC path to /System/MediaEncoder/Path which points to an executable on the network share, causing Jellyfin server to run the executable in the local context. Approximately 355,217 devices are potentially affected, mainly distributed in China, the United States, and other countries.
Recommendations For versions prior to 10.8.13, update to version 10.8.13 or later, as the vulnerable endpoint was removed in this version. As a temporary workaround, consider restricting access to the /System/MediaEncoder/Path endpoint until the update is applied. Additionally, avoid using the ValidateVersion function via the ProcessStartInfo until the issue is resolved.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2023-48702
GHSA-RR9H-W522-CVMR

Affected Products

Jellyfin