PT-2024-29494 · Ampache · Ampache

Hebing123 · Published 2024-07-23 · Updated 2024-07-24 · CVE-2024-41665

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Ampache versions prior to 6.6.0

Description The issue is a stored cross-site scripting (XSS) vulnerability in the "Playlists - Democratic - Configure Democratic Playlist" feature. An attacker with Content Manager permissions can exploit this by setting the Name field to malicious code, such as <svg onload=alert(8)>, which will affect administrators or users accessing the Democratic functionality. This can lead to the attacker obtaining cookies of affected users. The vulnerability is exploited through the democratic.php file.

Recommendations For versions prior to 6.6.0, update to version 6.6.0 to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-41665

GHSA-CP44-89R2-FXPH

Affected Products

Ampache

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41665.json · Exploit
• https://github.com/ampache/ampache/security/advisories/GHSA-cp44-89r2-fxph · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41665 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41665 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-41665 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-41665 · Security Note
• https://ubuntu.com/security/CVE-2024-41665 · Vendor Advisory
• https://t.me/cvedetector/1521 · Telegram Post