PT-2024-29336 · Navidrome · Navidrome

Yuexi Zhang · Published 2024-08-01 · Updated 2025-08-26 · CVE-2024-41259

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Navidrome version 0.52.3

Description The issue concerns the use of an insecure hashing algorithm, specifically MD5, in the Gravatar service of Navidrome. This allows attackers to manipulate a user's account information.

Recommendations For Navidrome version 0.52.3, consider disabling the use of the MD5 hashing algorithm in the Gravatar service until a secure alternative is implemented. Restrict access to account information to minimize the risk of exploitation.

Fix

Missing Authentication

Information Disclosure

Weakness Enumeration

CWE-306

CWE-200

CWE-305

Related Identifiers

CVE-2024-41259

GHSA-HRMX-8JJV-G758

GO-2024-3029

Affected Products

Navidrome

References · 11

• https://osv.dev/vulnerability/CVE-2024-41259 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41259 · Security Note
• https://osv.dev/vulnerability/GHSA-hrmx-8jjv-g758 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3029 · Vendor Advisory
• https://github.com/navidrome/navidrome · Note
• https://t.me/cvenotify/88591 · Telegram Post
• https://gist.github.com/nyxfqq/d192af10b53a363e2d9e430068333e04 · Note
• https://github.com/advisories/GHSA-hrmx-8jjv-g758 · Note
• https://t.me/cveNotify/133385 · Telegram Post
• https://pkg.go.dev/vuln/GO-2024-3029 · Note
• https://t.me/cvedetector/2270 · Telegram Post